Get password from ASP.net Basic Authentication

[netadmin]

Is it possible to get the password a user used for ASP.net Basic authentication login? I need to set both the username and password as cleartext variables. I have been able to get the username successfully, but have not found a way to get the password yet.

 

Any ideas?

[srochford]

You can't - the authentication is handled by the server and you don't get the password.

 

What you could do is collect the username and password using a form (on a page accessible without authentication). You then check that password is valid (I do it by trying to bind to that username in AD using the username and password) and do whatever after that.

 

Might be a daft question, but why do you want a user's password? It's not generally a good idea :-)

[netadmin]

Thanks. I'll take a look at using forms.

 

I am trying to create a page where users login to an ASP.net application hosted on our campus server, and can click a button to connect to a PHP application hosted on our external web host, and not have to sign in again. (My thinking was to capture the username and password from ASP and send these to the PHP application as hidden form fields to silently and automatically log them into that application). I was going to have ASP destroy the password variable immediately after completing the PHP login for security reasons.

[LynxSI]

I realize this thread is a month or two old, but it drives me nuts when "you can't" responses becomes a permanent part of the internet landscape rather than a constructive community effort to solve the problem at hand.

 

netadmin:

Basic authentication encodes both the username and password in a HTTP header variable in base64 encoding. You can pull out this header, remove the string prefix, decode the base 64 string and split the output at the ':'.

 

Try something like this:

           string requestUsername;
           string requestPassword;
           try
           {
               // The header is in the following format
               // "Basic 64BitEncodedUsernameAndPasswordString"
               string userAndPassEncoded = this.Context.Request.Headers["Authorization"].Substring(6);
               // userAndPasswordDecoded is in the following
               // format "theusername:thepassword"
               string userAndPassDecoded = new System.Text.ASCIIEncoding().GetString(
                   Convert.FromBase64String(this.Context.Request.Headers["Authorization"].Substring(6)));
               string[] userAndPasswordArray = userAndPassDecoded.Split(':');
               requestUsername = userAndPasswordArray[0];
               requestPassword = userAndPasswordArray[1];
           }
           catch (Exception ex)
           {
               throw new ApplicationException("Unable to get the Basic Authentication credentials from the request", ex);
           }

 

Best Regards,