Is is possible to determine a password input string as plaintext or hashed?
Posted
by Godders
on Stack Overflow
See other posts from Stack Overflow
or by Godders
Published on 2010-03-31T09:37:07Z
Indexed on
2010/03/31
9:43 UTC
Read the original article
Hit count: 256
I have a RESTful API containing a URI of /UserService/Register. /UserService/Register takes an XML request such as:
<UserRegistrationRequest>
<Password>password</Password>
<Profile>
<User>
<UserName>username</UserName>
</User>
</Profile>
</UserRegistrationRequest>
I have the following questions given the above scenario:
Is there a way (using C# and .Net 3.5+) of enforcing/validating that clients calling Register are passing a hashed password rather than plaintext? Is leaving the choice of hashing algorithm to be used to the client a good idea?
We could provide a second URI of /UserService/ComputePasswordHash which the client would call before calling /UserService/Register. This has the benefit of ensuring that each password is hashed using the same algorithm. Is there a mechanism within REST to ensure that a client has called one URI before calling another?
Hope I've explained myself ok.
Many thanks in advance for any help.
© Stack Overflow or respective owner
