ASP.NET Core Interview Question #141

How are passwords stored securely with ASP.NET Core Identity?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

ASP.NET Core Identity stores password hashes rather than plaintext passwords. Its password hasher uses a salted, deliberately expensive password-based hashing approach and stores metadata needed to verify and, when appropriate, upgrade hashes.

Detailed Explanation

ASP.NET Core Identity stores password hashes rather than plaintext passwords. Its password hasher uses a salted, deliberately expensive password-based hashing approach and stores metadata needed to verify and, when appropriate, upgrade hashes.

Application code should never store or log plaintext passwords and should not replace the framework hasher with fast general-purpose hashes such as SHA-256. Password reset should use secure time-limited tokens rather than revealing an existing password.

Code Example

var user = new ApplicationUser { UserName = model.Email, Email = model.Email };

var result = await _userManager.CreateAsync(
    user,
    model.Password); // Identity hashes the password.