WebMatrix WebSecurity PasswordSalt

Question

I am using WebMatrix and have built a website based on the "StarterSite". In this starter site you get a nice basic layout - including registration, login, forgot password pages etc...

I've noticed that in the database that the "webpages_Membership" table has a column named "PasswordSalt". After creating a few new user accounts, this column always remains blank. So I'm assuming that no password salt (not even a default one) is in use.

Obviously this is not the best practice, however I cannot seem to find any documentation that tells me how to set or manage the password salt.

How can I set the password salt with the WebSecurity Helper?

Answer 1

The above answer gives the impression that there is no salting applied when using WebSecurity SimpleMembershipProvider.

That is not true. Indeed the database salt field is not used, however this does not indicate that there is no salt generated when hashing the password.

In WebSecuritys SimpleMembershipProvider the PBKDF2 algo is used, the random salt is generated by the StaticRandomNumberGenerator and stored in the password field with the hash:

byte[] outputBytes = new byte[1 + SALT_SIZE + PBKDF2_SUBKEY_LENGTH];
Buffer.BlockCopy(salt, 0, outputBytes, 1, SALT_SIZE); 
Buffer.BlockCopy(subkey, 0, outputBytes, 1 + SALT_SIZE, PBKDF2_SUBKEY_LENGTH);
return Convert.ToBase64String(outputBytes);

Answer 2

As of the RTM release of WebMatrix/ASP.NET Web Pages, the salt feature/column is unused.

If you open up the Web Pages source, you'll see the db classes littered with references like

INSERT INTO [" + MembershipTableName + "] (UserId, [Password], PasswordSalt

...

VALUES (uid, hashedPassword,String.Empty /* salt column is unused */

shortened for emphasis

There are definately ways to override and implement this behavior, first being:

• override System.WebData.SimpleMembershipProvider.CreateAccount()

or

• extend with System.WebData.SimpleMembershipProvider.CreateAccountWithPasswordSalt()

not going to go into detail there though unless you request, as your usage of WebMatrix and a template suggests you probably don't wanna mess with rewriting a ton of your own C#/ASP code for this project.