authentication - Can you validate an inactive user's password in ASP.NET's membership system? -
I am creating an activation form for newly created users in ASP.Net membership system. When a user is created, I send an email with a link to an activation page. However, before the user is activated, I want to verify my username and password, so I have recorded my credentials in the text box.
However, what I have read and the behavior that I am seeing, it appears that I have to activate the user before I can test the password, either with form authentication. Or membership. ValidateUser I think this is a potential security weakness - is there any way around it?
Thank you,
Graham
Comments
Post a Comment