How to check asp.net core hash password in stored procedure

Question

Hi there;

There are countless of SQL stored procedures examples that check plain text passwords which is a bad security practice. I initially used ASP.NET Core Identity so the password were hashed and saved in the datatabase, but not I want to use DAPPER as a User Store. My question is

1. Does asp.net core hashes the passwords also using Dapper as an User Store?
2. If not, how I manually hash the password before passing as a parameter in the web Api.

Thanks in advance.

Answer 1

Does asp.net core hashes the passwords also using Dapper as an User Store?

You'll write asp.net Core code to hash the password. The password hash is stored in your User Store table. The official documentation covers the basics.

https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/consumer-apis/password-hashing?view=aspnetcore-8.0

Answer 2

1. Does asp.net core hashes the passwords also using Dapper as an User Store?

Yes. Please consider customizing the storage provider for the ASP.NET Core Identity as described in the following Microsoft document:

Custom storage providers for ASP.NET Core Identity

"To create a custom storage provider, create the data source, the data access layer, and the store classes that interact with this data access layer (the green and grey boxes in the diagram above). You don't need to customize the managers or your app code that interacts with them (the blue boxes above)."

The "Identity Manager" layer (the blue box in the above figure) automatically hashes the password and stores the hashed password in the database.

In addition to the password hash, the "Identity Manager" layer enables the validations of user id and password according to the settings described in the Microsoft document Configure Identity services.

Therefore, the customized provider will work as a part of the ASP.NET Core Identity system in which automatic redirect to login page, authentication cookie generation and the other functions required for the user authentication are made available.

As for sample codes please see the following documents:

Customize ASP.NET Core Identity

Using your own database schema and classes with ASP.NET Core Identity and Entity Framework Core