Using the PasswordRecovery control in .NET

Maker Code 3/9 in .NET Using the PasswordRecovery control

The PasswordRecovery control lets a user retrieve a forgotten password The user must correctly answer the secret question on file for the user Then the password is reset to a random value, and the new password is e-mailed to the e-mail address on file with the user

E-mail is inherently insecure, and the password sent to the user is not encrypted As a result, you should carefully evaluate your application s security requirements before you use this control In its simplest form, the PasswordRecovery control looks like this: <asp:PasswordRecovery id= PasswordRecovery1 runat= Server > <MailDefinition From= name@domaincom Subject= Subject Line BodyFileName= BodyFiletxt /> </asp:PasswordRecovery> If you prefer, you can code the mail-definition settings directly into the <PasswordRecovery> element, like this: <asp:PasswordRecovery id= PasswordRecovery1 runat= Server MailDefinition-From= name@domaincom MailDefinition-Subject= Subject Line MailDefinition-BodyFileName= BodyFiletxt /> </asp:PasswordRecovery> As you can see, the <MailDefinition> child element is required to provide the information necessary to send an e-mail message with the user s name and password As with the CreateUserWizard control, the body of the e-mail message is supplied by a text file that can include the variables <%UserName%> and <%Password%>, which are replaced by the user s name and password when the mail is sent The attributes listed in Table 3-3 let you customize the appearance of the PasswordRecovery control Here s an example that changes the text labels displayed by the control: <asp:PasswordRecovery id= PasswordRecovery1 runat= Server UserNameTitleText= Forgot Your Password Again, Eh <br /><br /> UserNameInstructionText= Enter your user name<br /><br /> UserNameLabelText= User name: QuestionTitleText= Forgot Your Password Again, Eh <br /><br /> QuestionInstructionText= Answer the secret question<br /><br /> QuestionLabelText= <br />Secret question: AnswerLabelText= <br />Your answer: SuccessText= Your new password has been e-mailed to you />

Part II: Building Secure Applications Table 3-3

The ID associated with the PasswordRecovery control Runat=Server is required for all ASPNET server controls The text that s displayed in the label for the Answer field The text that s displayed if the password can t be recovered The text that s displayed if the user provides the wrong answer for the secret question The text that s displayed in the label that instructs the user to answer the secret question The text that s displayed in the label that identifies the secret question The text that s displayed in the title area when the secret question is asked The URL of an image used on the Submit button The text displayed on the Submit button The button type for the Submit button You can specify Button, Link, or Image The URL of the page to be displayed when the password has been successfully recovered The text to display when the password has been successfully recovered Note that this text is not displayed if the SuccessPageUrl is provided Specifies the position of the labels relative to the user name and password text boxes If you specify TextOnLeft, the labels appear to the left of the text boxes If you specify TextOnTop, the labels appear above the text boxes

QuestionLabelText QuestionTitleText SubmitButtonImageUrl SubmitButtonText SubmitButtonType SuccessPageUrl SuccessText

The text that s displayed if the user provides an incorrect user name The text that s displayed in the instruction area when the user name is requested The text that s displayed in the label that identifies the User Name field The text that s displayed in the title area when the user name is requested

The ChangePassword control lets a user change his or her password The ChangePassword control can be configured to accept the user name of the account whose password you want to change If the control isn t configured to accept the user name, then the actual user must be logged in to change the password The ChangePassword control can also be configured to e-mail the new password to the user Note that because e-mail is inherently insecure, you should carefully evaluate your application s security requirements before you use this feature In its simplest form, the ChangePassword control looks like this: <asp:ChangePassword id= ChangePassword1 runat= Server /> If you want to e-mail the changed password to the user, you should add a <MailDefinition> child element, like this: <asp:ChangePassword id= ChangePassword1 runat= Server > <MailDefinition From= name@domaincom Subject= Subject Line BodyFileName= BodyFiletxt /> </asp:ChangePassword> Here, the body of the e-mail message is supplied by a text file that can include the variables <%UserName%> and <%Password%> When the message is sent, these variables are replaced by the user s name and password (You can see an example of how this works in 4)