asp.net MVC 密码恢复工具不起作用
我在 ASP.NET MVC 2 Web 应用程序中使用密码恢复控件。当我单击没有用户名的提交按钮时，它表明用户名丢失并带有星号。如果我输入用户名，表单会提交，但什么也不会发生。我在这里错过了什么吗？
Web.config：
<system.net>
<mailSettings>
<smtp deliveryMethod="Network" from="[email protected]">
<network host="mail.zzz.com" userName="[email protected]"
password="xxxxx" enableSsl="false" />
</smtp>
</mailSettings>
</system.net>
机器.config
<membership defaultProvider="MySQLMembershipProvider">
<providers>
<add name="MySQLMembershipProvider"
type="MySql.Web.Security.MySQLMembershipProvider, MySql.Web, Version=6.3.2.0, Culture=neutral, PublicKeyToken=c5687fc88969c44d"
autogenerateschema="true"
connectionStringName="LocalMySqlServer"
enablePasswordRetrieval="false"
enablePasswordReset="true"
requiresQuestionAndAnswer="false"
applicationName="/"
requiresUniqueEmail="true"
passwordFormat="Hashed"
maxInvalidPasswordAttempts="5"
minRequiredPasswordLength="6"
minRequiredNonalphanumericCharacters="1"
passwordAttemptWindow="10"
passwordStrengthRegularExpression="" />
</providers>
</membership>
I am using the password recovery control in an ASP.NET MVC 2 web app. When I click the submit button without a username, it indicates the username is missing with an asterisk. If I put in an a username the form submits but nothing happens. Am I missing something here?
Web.config:
<system.net>
<mailSettings>
<smtp deliveryMethod="Network" from="[email protected]">
<network host="mail.zzz.com" userName="[email protected]"
password="xxxxx" enableSsl="false" />
</smtp>
</mailSettings>
</system.net>
machine.config
<membership defaultProvider="MySQLMembershipProvider">
<providers>
<add name="MySQLMembershipProvider"
type="MySql.Web.Security.MySQLMembershipProvider, MySql.Web, Version=6.3.2.0, Culture=neutral, PublicKeyToken=c5687fc88969c44d"
autogenerateschema="true"
connectionStringName="LocalMySqlServer"
enablePasswordRetrieval="false"
enablePasswordReset="true"
requiresQuestionAndAnswer="false"
applicationName="/"
requiresUniqueEmail="true"
passwordFormat="Hashed"
maxInvalidPasswordAttempts="5"
minRequiredPasswordLength="6"
minRequiredNonalphanumericCharacters="1"
passwordAttemptWindow="10"
passwordStrengthRegularExpression="" />
</providers>
</membership>
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
根据您的配置，您正在使用散列密码并禁用密码检索。这意味着您无法恢复密码（因为它们是经过哈希处理的）。您只能重置它们。
这是一个安全设置，因此请勿更改它。但请注意，当密码经过哈希处理后，您无法“恢复”密码。
如果您的要求指定密码必须可恢复，那么您必须将passwordFormat更改为Encrypted并设置enablePasswordRetrieval =“true”。但请注意，数据库中的任何散列密码和密码答案都需要由用户重新输入，因为就提供商而言，当前值将“损坏”。要强制执行此更改，您可以覆盖登录页面中的 Authenticate 方法并检查用户的 LastPasswordChange 日期，然后将他们重定向到页面以重新配置其密码和答案，以便他们可以正确登录。
最后要提到的是，加密的密码是可检索的，因为它们可以被解密。这意味着它们的安全性较低。因此，如果可以的话，请坚持使用散列密码。
According to your configuration you're using hashed passwords and have password retrieval disabled. This means you cannot recover passwords (because they're hashed). You can only reset them.
This is a secure setup, so don't change it. But be aware that you cannot "recover" passwords when they're hashed.
If your requirements specify that passwords must be recoverable then you'll have to change the passwordFormat to Encrypted and set enablePasswordRetrieval="true". But know that any hashed passwords and password answers in your database will need to be re-entered by the user because the current values will be 'corrupt' as far as the provider is concerned. To enforce this change over, you could override the Authenticate method in your login page and check the user's LastPasswordChange date then redirect them to a page to reconfigure their password and answer so they can login properly.
One last thing to mention though is, encrypted passwords are retrievable because they can be decrypted. This means they are less secure. So stick with hashed passwords if you can.