{"id":1913,"date":"2024-06-16T20:36:19","date_gmt":"2024-06-16T20:36:19","guid":{"rendered":"https:\/\/www.w3computing.com\/articles\/?p=1913"},"modified":"2024-06-16T20:36:25","modified_gmt":"2024-06-16T20:36:25","slug":"implementing-secure-password-hashing-and-salting-in-c-web-applications","status":"publish","type":"post","link":"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/","title":{"rendered":"Implementing Secure Password Hashing and Salting in C# Web Applications"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Password security is a critical aspect of web application development. Protecting user credentials from unauthorized access is essential to maintaining user trust and compliance with legal requirements. One effective way to enhance password security is through hashing and salting. This tutorial will guide you through the process of implementing secure password hashing and salting in a C# web application.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Understanding Password Hashing and Salting<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Password Hashing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Hashing is a process that transforms a password into a fixed-size string of characters, which is typically a hexadecimal number. Hash functions are designed to be one-way, meaning that it is computationally infeasible to reverse the process and retrieve the original password from the hash.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Password Salting<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Salting involves adding a unique, random string (salt) to each password before hashing it. This ensures that even if two users have the same password, their hashed passwords will be different. Salting helps protect against rainbow table attacks, where precomputed hash values are used to crack passwords.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. Setting Up the Development Environment<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To begin, you need to set up your development environment. For this tutorial, you will need:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Visual Studio 2019 or later<\/li>\n\n\n\n<li>.NET Core SDK<\/li>\n\n\n\n<li>SQL Server (or another database of your choice)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ensure you have these installed and properly configured before proceeding.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Creating the C# Web Application<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create a New Project<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open Visual Studio.<\/li>\n\n\n\n<li>Click on &#8220;Create a new project.&#8221;<\/li>\n\n\n\n<li>Select &#8220;ASP.NET Core Web Application&#8221; and click &#8220;Next.&#8221;<\/li>\n\n\n\n<li>Name your project and solution, then click &#8220;Create.&#8221;<\/li>\n\n\n\n<li>Select &#8220;Web Application (Model-View-Controller)&#8221; and click &#8220;Create.&#8221;<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Set Up the Project Structure<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Your project should have the following structure:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Controllers<\/strong>: Contains the application controllers.<\/li>\n\n\n\n<li><strong>Models<\/strong>: Contains the data models.<\/li>\n\n\n\n<li><strong>Views<\/strong>: Contains the Razor views.<\/li>\n\n\n\n<li><strong>wwwroot<\/strong>: Contains static files such as CSS, JavaScript, and images.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">4. Implementing Password Hashing<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Add a Utility Class for Hashing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Create a new class named <code>HashingHelper<\/code> in the <code>Utilities<\/code> folder.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"C#\" data-shcb-language-slug=\"cs\"><span><code class=\"hljs language-cs\"><span class=\"hljs-keyword\">using<\/span> System;\n<span class=\"hljs-keyword\">using<\/span> System.Security.Cryptography;\n<span class=\"hljs-keyword\">using<\/span> System.Text;\n\n<span class=\"hljs-keyword\">namespace<\/span> <span class=\"hljs-title\">YourProject.Utilities<\/span>\n{\n    <span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">static<\/span> <span class=\"hljs-keyword\">class<\/span> <span class=\"hljs-title\">HashingHelper<\/span>\n    {\n        <span class=\"hljs-function\"><span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">static<\/span> <span class=\"hljs-keyword\">string<\/span> <span class=\"hljs-title\">HashPassword<\/span>(<span class=\"hljs-params\"><span class=\"hljs-keyword\">string<\/span> password, <span class=\"hljs-keyword\">byte<\/span>&#91;] salt<\/span>)<\/span>\n        {\n            <span class=\"hljs-keyword\">using<\/span> (<span class=\"hljs-keyword\">var<\/span> hmac = <span class=\"hljs-keyword\">new<\/span> HMACSHA512(salt))\n            {\n                <span class=\"hljs-keyword\">var<\/span> hashedPassword = hmac.ComputeHash(Encoding.UTF8.GetBytes(password));\n                <span class=\"hljs-keyword\">return<\/span> Convert.ToBase64String(hashedPassword);\n            }\n        }\n\n        <span class=\"hljs-function\"><span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">static<\/span> <span class=\"hljs-keyword\">byte<\/span>&#91;] <span class=\"hljs-title\">GenerateSalt<\/span>(<span class=\"hljs-params\"><\/span>)<\/span>\n        {\n            <span class=\"hljs-keyword\">var<\/span> salt = <span class=\"hljs-keyword\">new<\/span> <span class=\"hljs-keyword\">byte<\/span>&#91;<span class=\"hljs-number\">16<\/span>];\n            <span class=\"hljs-keyword\">using<\/span> (<span class=\"hljs-keyword\">var<\/span> rng = <span class=\"hljs-keyword\">new<\/span> RNGCryptoServiceProvider())\n            {\n                rng.GetBytes(salt);\n            }\n            <span class=\"hljs-keyword\">return<\/span> salt;\n        }\n    }\n}<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">C#<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">cs<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h3 class=\"wp-block-heading\">Step 2: Update the User Model<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Update your <code>User<\/code> model to include properties for the hashed password and salt.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-2\" data-shcb-language-name=\"C#\" data-shcb-language-slug=\"cs\"><span><code class=\"hljs language-cs\"><span class=\"hljs-keyword\">namespace<\/span> <span class=\"hljs-title\">YourProject.Models<\/span>\n{\n    <span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">class<\/span> <span class=\"hljs-title\">User<\/span>\n    {\n        <span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">int<\/span> Id { <span class=\"hljs-keyword\">get<\/span>; <span class=\"hljs-keyword\">set<\/span>; }\n        <span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">string<\/span> Username { <span class=\"hljs-keyword\">get<\/span>; <span class=\"hljs-keyword\">set<\/span>; }\n        <span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">string<\/span> PasswordHash { <span class=\"hljs-keyword\">get<\/span>; <span class=\"hljs-keyword\">set<\/span>; }\n        <span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">byte<\/span>&#91;] Salt { <span class=\"hljs-keyword\">get<\/span>; <span class=\"hljs-keyword\">set<\/span>; }\n    }\n}<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-2\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">C#<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">cs<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h2 class=\"wp-block-heading\">5. Implementing Password Salting<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Modify the Registration Process<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In the <code>AccountController<\/code>, update the registration action to hash and salt the password before saving it to the database.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-3\" data-shcb-language-name=\"C#\" data-shcb-language-slug=\"cs\"><span><code class=\"hljs language-cs\"><span class=\"hljs-keyword\">using<\/span> Microsoft.AspNetCore.Mvc;\n<span class=\"hljs-keyword\">using<\/span> YourProject.Models;\n<span class=\"hljs-keyword\">using<\/span> YourProject.Utilities;\n<span class=\"hljs-keyword\">using<\/span> YourProject.Data;\n\n<span class=\"hljs-keyword\">namespace<\/span> <span class=\"hljs-title\">YourProject.Controllers<\/span>\n{\n    <span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">class<\/span> <span class=\"hljs-title\">AccountController<\/span> : <span class=\"hljs-title\">Controller<\/span>\n    {\n        <span class=\"hljs-keyword\">private<\/span> <span class=\"hljs-keyword\">readonly<\/span> ApplicationDbContext _context;\n\n        <span class=\"hljs-function\"><span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-title\">AccountController<\/span>(<span class=\"hljs-params\">ApplicationDbContext context<\/span>)<\/span>\n        {\n            _context = context;\n        }\n\n        &#91;<span class=\"hljs-meta\">HttpPost<\/span>]\n        <span class=\"hljs-function\"><span class=\"hljs-keyword\">public<\/span> IActionResult <span class=\"hljs-title\">Register<\/span>(<span class=\"hljs-params\">User model<\/span>)<\/span>\n        {\n            <span class=\"hljs-keyword\">if<\/span> (ModelState.IsValid)\n            {\n                <span class=\"hljs-keyword\">var<\/span> salt = HashingHelper.GenerateSalt();\n                <span class=\"hljs-keyword\">var<\/span> hashedPassword = HashingHelper.HashPassword(model.Password, salt);\n\n                <span class=\"hljs-keyword\">var<\/span> user = <span class=\"hljs-keyword\">new<\/span> User\n                {\n                    Username = model.Username,\n                    PasswordHash = hashedPassword,\n                    Salt = salt\n                };\n\n                _context.Users.Add(user);\n                _context.SaveChanges();\n\n                <span class=\"hljs-keyword\">return<\/span> RedirectToAction(<span class=\"hljs-string\">\"Login\"<\/span>);\n            }\n\n            <span class=\"hljs-keyword\">return<\/span> View(model);\n        }\n    }\n}<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-3\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">C#<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">cs<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h3 class=\"wp-block-heading\">Step 2: Modify the Login Process<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Update the login action to verify the hashed and salted password.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-4\" data-shcb-language-name=\"C#\" data-shcb-language-slug=\"cs\"><span><code class=\"hljs language-cs\"><span class=\"hljs-keyword\">using<\/span> Microsoft.AspNetCore.Mvc;\n<span class=\"hljs-keyword\">using<\/span> YourProject.Models;\n<span class=\"hljs-keyword\">using<\/span> YourProject.Utilities;\n<span class=\"hljs-keyword\">using<\/span> YourProject.Data;\n<span class=\"hljs-keyword\">using<\/span> System.Linq;\n\n<span class=\"hljs-keyword\">namespace<\/span> <span class=\"hljs-title\">YourProject.Controllers<\/span>\n{\n    <span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">class<\/span> <span class=\"hljs-title\">AccountController<\/span> : <span class=\"hljs-title\">Controller<\/span>\n    {\n        <span class=\"hljs-keyword\">private<\/span> <span class=\"hljs-keyword\">readonly<\/span> ApplicationDbContext _context;\n\n        <span class=\"hljs-function\"><span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-title\">AccountController<\/span>(<span class=\"hljs-params\">ApplicationDbContext context<\/span>)<\/span>\n        {\n            _context = context;\n        }\n\n        &#91;<span class=\"hljs-meta\">HttpPost<\/span>]\n        <span class=\"hljs-function\"><span class=\"hljs-keyword\">public<\/span> IActionResult <span class=\"hljs-title\">Login<\/span>(<span class=\"hljs-params\">User model<\/span>)<\/span>\n        {\n            <span class=\"hljs-keyword\">if<\/span> (ModelState.IsValid)\n            {\n                <span class=\"hljs-keyword\">var<\/span> user = _context.Users.SingleOrDefault(u =&gt; u.Username == model.Username);\n                <span class=\"hljs-keyword\">if<\/span> (user != <span class=\"hljs-literal\">null<\/span>)\n                {\n                    <span class=\"hljs-keyword\">var<\/span> hashedPassword = HashingHelper.HashPassword(model.Password, user.Salt);\n                    <span class=\"hljs-keyword\">if<\/span> (hashedPassword == user.PasswordHash)\n                    {\n                        <span class=\"hljs-comment\">\/\/ User is authenticated<\/span>\n                        <span class=\"hljs-keyword\">return<\/span> RedirectToAction(<span class=\"hljs-string\">\"Index\"<\/span>, <span class=\"hljs-string\">\"Home\"<\/span>);\n                    }\n                }\n\n                ModelState.AddModelError(<span class=\"hljs-string\">\"\"<\/span>, <span class=\"hljs-string\">\"Invalid username or password\"<\/span>);\n            }\n\n            <span class=\"hljs-keyword\">return<\/span> View(model);\n        }\n    }\n}<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-4\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">C#<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">cs<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h2 class=\"wp-block-heading\">6. Storing and Verifying Passwords<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Storing Passwords<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When storing passwords, ensure that only the hashed password and salt are saved to the database. Never store plain text passwords.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Verifying Passwords<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">During login, retrieve the user&#8217;s salt and hashed password from the database. Use the same salt to hash the entered password and compare it with the stored hashed password. If they match, the user is authenticated.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">7. Integrating with a Database<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Configure the Database Context<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Add the <code>ApplicationDbContext<\/code> class in the <code>Data<\/code> folder.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-5\" data-shcb-language-name=\"C#\" data-shcb-language-slug=\"cs\"><span><code class=\"hljs language-cs\"><span class=\"hljs-keyword\">using<\/span> Microsoft.EntityFrameworkCore;\n<span class=\"hljs-keyword\">using<\/span> YourProject.Models;\n\n<span class=\"hljs-keyword\">namespace<\/span> <span class=\"hljs-title\">YourProject.Data<\/span>\n{\n    <span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">class<\/span> <span class=\"hljs-title\">ApplicationDbContext<\/span> : <span class=\"hljs-title\">DbContext<\/span>\n    {\n        <span class=\"hljs-function\"><span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-title\">ApplicationDbContext<\/span>(<span class=\"hljs-params\">DbContextOptions&lt;ApplicationDbContext&gt; options<\/span>) : <span class=\"hljs-title\">base<\/span>(<span class=\"hljs-params\">options<\/span>)<\/span>\n        {\n        }\n\n        <span class=\"hljs-keyword\">public<\/span> DbSet&lt;User&gt; Users { <span class=\"hljs-keyword\">get<\/span>; <span class=\"hljs-keyword\">set<\/span>; }\n    }\n}<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-5\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">C#<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">cs<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h3 class=\"wp-block-heading\">Step 2: Update the Connection String<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Update the <code>appsettings.json<\/code> file with your database connection string.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-6\" data-shcb-language-name=\"C#\" data-shcb-language-slug=\"cs\"><span><code class=\"hljs language-cs\">{\n  <span class=\"hljs-string\">\"ConnectionStrings\"<\/span>: {\n    <span class=\"hljs-string\">\"DefaultConnection\"<\/span>: <span class=\"hljs-string\">\"Server=your_server;Database=your_database;User Id=your_user;Password=your_password;\"<\/span>\n  },\n  <span class=\"hljs-string\">\"Logging\"<\/span>: {\n    <span class=\"hljs-string\">\"LogLevel\"<\/span>: {\n      <span class=\"hljs-string\">\"Default\"<\/span>: <span class=\"hljs-string\">\"Information\"<\/span>,\n      <span class=\"hljs-string\">\"Microsoft\"<\/span>: <span class=\"hljs-string\">\"Warning\"<\/span>,\n      <span class=\"hljs-string\">\"Microsoft.Hosting.Lifetime\"<\/span>: <span class=\"hljs-string\">\"Information\"<\/span>\n    }\n  },\n  <span class=\"hljs-string\">\"AllowedHosts\"<\/span>: <span class=\"hljs-string\">\"*\"<\/span>\n}<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-6\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">C#<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">cs<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h3 class=\"wp-block-heading\">Step 3: Configure the Service in <code>Startup.cs<\/code><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In the <code>ConfigureServices<\/code> method of the <code>Startup.cs<\/code> file, add the database context service.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-7\" data-shcb-language-name=\"C#\" data-shcb-language-slug=\"cs\"><span><code class=\"hljs language-cs\"><span class=\"hljs-function\"><span class=\"hljs-keyword\">public<\/span> <span class=\"hljs-keyword\">void<\/span> <span class=\"hljs-title\">ConfigureServices<\/span>(<span class=\"hljs-params\">IServiceCollection services<\/span>)<\/span>\n{\n    services.AddDbContext&lt;ApplicationDbContext&gt;(options =&gt;\n        options.UseSqlServer(Configuration.GetConnectionString(<span class=\"hljs-string\">\"DefaultConnection\"<\/span>)));\n\n    services.AddControllersWithViews();\n}<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-7\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">C#<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">cs<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create the Database<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Run the following commands in the Package Manager Console to create the database:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-8\" data-shcb-language-name=\"Shell Session\" data-shcb-language-slug=\"shell\"><span><code class=\"hljs language-shell\">Add-Migration InitialCreate\nUpdate-Database<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-8\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">Shell Session<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">shell<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h2 class=\"wp-block-heading\">8. Enhancing Security with Additional Measures<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Use a Strong Hashing Algorithm<\/strong> &#8211; While HMACSHA512 is used in this tutorial, consider using stronger algorithms like bcrypt, scrypt, or Argon2 for better security.<\/li>\n\n\n\n<li><strong>Implement Account Lockout<\/strong> &#8211; To prevent brute force attacks, implement account lockout after a certain number of failed login attempts.<\/li>\n\n\n\n<li><strong>Use HTTPS<\/strong> &#8211; Ensure your web application uses HTTPS to encrypt data transmitted between the client and server.<\/li>\n\n\n\n<li><strong>Implement Multi-Factor Authentication (MFA)<\/strong> &#8211; Add an extra layer of security by implementing MFA, requiring users to provide additional verification methods.<\/li>\n\n\n\n<li><strong>Regularly Update Security Practices<\/strong> &#8211; Stay informed about the latest security practices and update your application accordingly.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">9. Testing the Implementation<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Register a New User<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Run the application.<\/li>\n\n\n\n<li>Navigate to the registration page.<\/li>\n\n\n\n<li>Register a new user and verify that the password is hashed and salted before being stored in the database.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Log In with the Registered User<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Navigate to the login page.<\/li>\n\n\n\n<li>Log in with the registered user&#8217;s credentials.<\/li>\n\n\n\n<li>Verify that the hashed and salted password is correctly verified.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Test Edge Cases<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Test with incorrect passwords to ensure they are not authenticated.<\/li>\n\n\n\n<li>Test with multiple users having the same password to ensure unique salts produce different hashed passwords.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Implementing secure password hashing and salting is crucial for protecting user credentials in web applications. This tutorial provided a comprehensive guide to integrating these security measures into a C# web application, covering the concepts of hashing and salting, setting up the development environment, implementing the functionality, and enhancing security with additional measures.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Password security is a critical aspect of web application development. Protecting user credentials from unauthorized access is essential to maintaining user trust and compliance with legal requirements. One effective way to enhance password security is through hashing and salting. This tutorial will guide you through the process of implementing secure password hashing and salting [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[8,4],"tags":[],"class_list":["post-1913","post","type-post","status-publish","format-standard","category-csharp","category-programming-languages","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Implementing Secure Password Hashing and Salting in C# Web Applications<\/title>\n<meta name=\"description\" content=\"Password security is a critical aspect of web application development. Protecting user credentials from unauthorized access is essential to\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Implementing Secure Password Hashing and Salting in C# Web Applications\" \/>\n<meta property=\"og:description\" content=\"Password security is a critical aspect of web application development. Protecting user credentials from unauthorized access is essential to\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-06-16T20:36:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-06-16T20:36:25+00:00\" \/>\n<meta name=\"author\" content=\"w3compadmin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"w3compadmin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/implementing-secure-password-hashing-and-salting-in-c-web-applications\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/implementing-secure-password-hashing-and-salting-in-c-web-applications\\\/\"},\"author\":{\"name\":\"w3compadmin\",\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/#\\\/schema\\\/person\\\/a550b3e20d78bb4f79b7c6b7b53f0561\"},\"headline\":\"Implementing Secure Password Hashing and Salting in C# Web Applications\",\"datePublished\":\"2024-06-16T20:36:19+00:00\",\"dateModified\":\"2024-06-16T20:36:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/implementing-secure-password-hashing-and-salting-in-c-web-applications\\\/\"},\"wordCount\":756,\"articleSection\":[\"C#\",\"Programming Languages\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/implementing-secure-password-hashing-and-salting-in-c-web-applications\\\/\",\"url\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/implementing-secure-password-hashing-and-salting-in-c-web-applications\\\/\",\"name\":\"Implementing Secure Password Hashing and Salting in C# Web Applications\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/#website\"},\"datePublished\":\"2024-06-16T20:36:19+00:00\",\"dateModified\":\"2024-06-16T20:36:25+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/#\\\/schema\\\/person\\\/a550b3e20d78bb4f79b7c6b7b53f0561\"},\"description\":\"Password security is a critical aspect of web application development. Protecting user credentials from unauthorized access is essential to\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/implementing-secure-password-hashing-and-salting-in-c-web-applications\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/implementing-secure-password-hashing-and-salting-in-c-web-applications\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/implementing-secure-password-hashing-and-salting-in-c-web-applications\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Articles Home\",\"item\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Programming Languages\",\"item\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/programming-languages\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Implementing Secure Password Hashing and Salting in C# Web Applications\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/#website\",\"url\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/\",\"name\":\"Developer Articles Hub\",\"description\":\"\",\"alternateName\":\"Developer Articles\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/#\\\/schema\\\/person\\\/a550b3e20d78bb4f79b7c6b7b53f0561\",\"name\":\"w3compadmin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/wp-content\\\/litespeed\\\/avatar\\\/bd481d404e42caa2763662a3bfe825f8.jpg?ver=1780141266\",\"url\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/wp-content\\\/litespeed\\\/avatar\\\/bd481d404e42caa2763662a3bfe825f8.jpg?ver=1780141266\",\"contentUrl\":\"https:\\\/\\\/www.w3computing.com\\\/articles\\\/wp-content\\\/litespeed\\\/avatar\\\/bd481d404e42caa2763662a3bfe825f8.jpg?ver=1780141266\",\"caption\":\"w3compadmin\"},\"sameAs\":[\"http:\\\/\\\/w3computing.com\\\/articles\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Implementing Secure Password Hashing and Salting in C# Web Applications","description":"Password security is a critical aspect of web application development. Protecting user credentials from unauthorized access is essential to","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/","og_locale":"en_US","og_type":"article","og_title":"Implementing Secure Password Hashing and Salting in C# Web Applications","og_description":"Password security is a critical aspect of web application development. Protecting user credentials from unauthorized access is essential to","og_url":"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/","article_published_time":"2024-06-16T20:36:19+00:00","article_modified_time":"2024-06-16T20:36:25+00:00","author":"w3compadmin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"w3compadmin","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/#article","isPartOf":{"@id":"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/"},"author":{"name":"w3compadmin","@id":"https:\/\/www.w3computing.com\/articles\/#\/schema\/person\/a550b3e20d78bb4f79b7c6b7b53f0561"},"headline":"Implementing Secure Password Hashing and Salting in C# Web Applications","datePublished":"2024-06-16T20:36:19+00:00","dateModified":"2024-06-16T20:36:25+00:00","mainEntityOfPage":{"@id":"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/"},"wordCount":756,"articleSection":["C#","Programming Languages"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/","url":"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/","name":"Implementing Secure Password Hashing and Salting in C# Web Applications","isPartOf":{"@id":"https:\/\/www.w3computing.com\/articles\/#website"},"datePublished":"2024-06-16T20:36:19+00:00","dateModified":"2024-06-16T20:36:25+00:00","author":{"@id":"https:\/\/www.w3computing.com\/articles\/#\/schema\/person\/a550b3e20d78bb4f79b7c6b7b53f0561"},"description":"Password security is a critical aspect of web application development. Protecting user credentials from unauthorized access is essential to","breadcrumb":{"@id":"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.w3computing.com\/articles\/implementing-secure-password-hashing-and-salting-in-c-web-applications\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Articles Home","item":"https:\/\/www.w3computing.com\/articles\/"},{"@type":"ListItem","position":2,"name":"Programming Languages","item":"https:\/\/www.w3computing.com\/articles\/programming-languages\/"},{"@type":"ListItem","position":3,"name":"Implementing Secure Password Hashing and Salting in C# Web Applications"}]},{"@type":"WebSite","@id":"https:\/\/www.w3computing.com\/articles\/#website","url":"https:\/\/www.w3computing.com\/articles\/","name":"Developer Articles Hub","description":"","alternateName":"Developer Articles","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.w3computing.com\/articles\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.w3computing.com\/articles\/#\/schema\/person\/a550b3e20d78bb4f79b7c6b7b53f0561","name":"w3compadmin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.w3computing.com\/articles\/wp-content\/litespeed\/avatar\/bd481d404e42caa2763662a3bfe825f8.jpg?ver=1780141266","url":"https:\/\/www.w3computing.com\/articles\/wp-content\/litespeed\/avatar\/bd481d404e42caa2763662a3bfe825f8.jpg?ver=1780141266","contentUrl":"https:\/\/www.w3computing.com\/articles\/wp-content\/litespeed\/avatar\/bd481d404e42caa2763662a3bfe825f8.jpg?ver=1780141266","caption":"w3compadmin"},"sameAs":["http:\/\/w3computing.com\/articles"]}]}},"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"w3compadmin","author_link":"https:\/\/www.w3computing.com\/articles\/author\/w3compadmin\/"},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.w3computing.com\/articles\/wp-json\/wp\/v2\/posts\/1913","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.w3computing.com\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.w3computing.com\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.w3computing.com\/articles\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.w3computing.com\/articles\/wp-json\/wp\/v2\/comments?post=1913"}],"version-history":[{"count":1,"href":"https:\/\/www.w3computing.com\/articles\/wp-json\/wp\/v2\/posts\/1913\/revisions"}],"predecessor-version":[{"id":1914,"href":"https:\/\/www.w3computing.com\/articles\/wp-json\/wp\/v2\/posts\/1913\/revisions\/1914"}],"wp:attachment":[{"href":"https:\/\/www.w3computing.com\/articles\/wp-json\/wp\/v2\/media?parent=1913"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.w3computing.com\/articles\/wp-json\/wp\/v2\/categories?post=1913"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.w3computing.com\/articles\/wp-json\/wp\/v2\/tags?post=1913"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}