0

I have tried for a couple of hours to check whether the user account is locked or not since Membership.GetUser(Login1.UserName) always returns null.

Here is my code where I check the value in "OnLoginError" method:

protected void login_inError(object sender, EventArgs e)
{
    MembershipUser user = Membership.GetUser(Login1.UserName);
   //Membership.Providers["SqlProvider"].GetUser(Login1.UserName, false);

    if (user == null)
    {
        Login1.FailureText = "sorry there is no such username";
    }
    else
    {
        if (!user.IsApproved)
        {

            Login1.FailureText = "your account has been approved yet!!";
        }

        else if (user.IsLockedOut)
        {

            Login1.FailureText = "your account has been blocked";
        }

        else
        {

          Login1.FailureText = "sorry your password incorrect";             
        }
    }
}

Here is provider config:

<membership defaultProvider="SqlProvider">
    <providers>
        <!-- Add the new SqlMembershipProvider-->
        <add name="SqlProvider" type="System.Web.Security.SqlMembershipProvider"
             connectionStringName="ConnectionString" maxInvalidPasswordAttempts="3" 
             passwordAttemptWindow="1"
             passwordFormat="Hashed"
             applicationName="WebSite5"/>
    </providers>
</membership>
pwdst
  • 13,909
  • 3
  • 34
  • 50
Mariam
  • 37
  • 1
  • 7
  • Depending on the nature of your site you may not wish to confirm that a username exists or not, especially if you use email addresses as usernames and particularly if users may not want existence of their account to be publicly disclosed. Existence of a valid username can also make it easier for for attackers to "brute force" accounts. Best practice is generally considered to show the message "Username or password incorrect" rather than specific details. This blog post may be useful https://www.troyhunt.com/website-enumeration-insanity-how-our-personal-data-is-leaked/ – pwdst Sep 24 '17 at 11:52
  • Have you debugged to see what value Login1.UserName has at this point in the page life cycle? There is nothing in the [documentation](https://msdn.microsoft.com/en-us/library/40w5063z(v=vs.110).aspx) that suggests that a valid username will not return the user object if the user account is locked out. If the value of the input *has* been reset by the failed login then an empty string will be passed to the method and of course return null as a result. – pwdst Sep 24 '17 at 12:25
  • @pwdst thanks :) yes i did where i got correct value of username but membership.getuser(login1.username) return null i think because of invalid login. Anyway, let me explain the scenario i want after 3 failed attempts the account is lock and a message display for the user . Is there any alternative ways ? like oracle introduce a custom profile for password – Mariam Sep 24 '17 at 19:21

0 Answers0