Aspnetcore.docs: Example on how to verify hashed password when using the given example

[maillouxc]

It's not clear how to do so.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: fc1052d7-e93f-fcb8-6d87-d86cededad23
• Version Independent ID: 61e65ca8-4008-ed27-7254-93385a9ed6d7
• Content: Hash passwords in ASP.NET Core
• Content Source: aspnetcore/security/data-protection/consumer-apis/password-hashing.md
• Product: aspnet-core
• GitHub Login: @Rick-Anderson
• Microsoft Alias: riande

[Rick-Anderson]

See the sample code

KeyDerivation.Pbkdf2(
            password: password,
            salt: salt,
            prf: KeyDerivationPrf.HMACSHA1,
            iterationCount: 10000,
            numBytesRequested: 256 / 8)

or the link to the source code.

[michael-freidgeim-webjet]

It will be useful to include in the article body something like ValidatePassword(string password, string correctHash) from https://cmatskas.com/-net-password-hashing-using-pbkdf2/

[maillouxc]

I ended up using the PasswordHasher class from identity instead, the one that was linked on this page.

At first I was reluctant to use it because I am using authentication without identity and the mentioned class requires a user type as generic parameter, but it turns out it's not actually used anywhere in the class.

This should be documented somewhere, there is really no need to write code such as this for 99% of use cases it seems.

I'm still not sure why the PasswordHasher class requires a user parameter when the user is never used anywhere in the class.

[Rick-Anderson]

@blowdart please review:

• > It will be useful to include in the article body something like ValidatePassword(string password, string correctHash) from https://cmatskas.com/-net-password-hashing-using-pbkdf2/
• > why the PasswordHasher class requires a user parameter

[blowdart]

So for passwordhasher the parameter is there in case someone wants it for derived classes.

For the comparison I'd just use in the code in Identity, and cut and paste that.

[Rick-Anderson]

Thanks for contacting us. We believe that the question you've raised have been answered. If you still feel a need to continue the discussion, feel free to reopen it and add your comments.

[Ogieeeeee]

Can we have an example on how to verify a (string) password with a hashed password?