ASP.NET Core生成的密码哈希在ASP.NET 4.8环境验证失败的解决方法

平台信息 #

• ASP.NET Core 7.0
• Visual Studio 2022
• C++
• ASP.NET 4.8

问题背景 #

我们有两个应用共享同一用户表：

• 集成Entity Framework的ASP.NET Core Web API，负责存储用户名和密码哈希
• C++应用，通过ASP.NET 4.8框架库验证用户登录信息

问题现象 #

• 当密码哈希由ASP.NET 4.8库生成并存入表时，两个应用均可正常验证用户名和密码
• 当密码哈希由ASP.NET Core Web API生成时，仅ASP.NET Core自身能验证成功，C++应用验证失败

需求 #

找到让C++应用能够验证ASP.NET Core Web API生成的密码哈希的方法

原验证代码 #

ASP.NET 4.8密码验证代码 #

using Microsoft.AspNet.Identity;

public bool VerifyHashPasswd(string hashedPassword, string plainPassword)
{
      var hasher = new Microsoft.AspNet.Identity.PasswordHasher();
      var successResult = hasher.VerifyHashedPassword(hashedPassword, plainPassword);
      return successResult.ToString().Equals("success", StringComparison.OrdinalIgnoreCase);
}

ASP.NET Core密码验证代码 #

public class AppUserManager : UserManager<TableUserInfo>
{
    // UserInfoStore store2= new UserInfoStore;

    public AppUserManager(IUserStore<TableUserInfo> store,
                          IOptions<IdentityOptions> optionsAccessor,
                          IPasswordHasher<TableUserInfo> passwordHasher,
                          IEnumerable<IUserValidator<TableUserInfo>> userValidators,
                          IEnumerable<IPasswordValidator<TableUserInfo>> passwordValidators,
                          ILookupNormalizer keyNormalizer,
                          IdentityErrorDescriber errors,
                          IServiceProvider services,
                          ILogger<UserManager<TableUserInfo>> logger)
    : base(store, optionsAccessor, passwordHasher, userValidators, passwordValidators, keyNormalizer, errors, services, logger)
    {
    }


    public override async Task<bool> CheckPasswordAsync(TableUserInfo user, string password)
    {
        ThrowIfDisposed();

        var passwordStore = GetPasswordStore();

        if (user == null)
        {
            return false;
        }

        var result = await VerifyPasswordAsync(passwordStore, user, password).ConfigureAwait(false);

        var success = result != PasswordVerificationResult.Failed;

        return success;
    }

    private IUserPasswordStore<TableUserInfo> GetPasswordStore()
    {
        var cast = Store as IUserPasswordStore<TableUserInfo>;

        if (cast == null)
        {
            throw new NotSupportedException("StoreNotIUserPasswordStore");
        }

        return cast;
    }
}

解决方案 #

ASP.NET Core与ASP.NET 4.8的PasswordHasher哈希格式及验证逻辑存在差异，ASP.NET 4.8原生哈希器无法识别ASP.NET Core生成的哈希结构。需在C++应用依赖的ASP.NET 4.8项目中，改用ASP.NET Core Identity的PasswordHasher进行验证，具体代码如下：

实现代码 #

public class UserInfo : IdentityUser<int>
{
    public string? FirstName { get; set; }
    public string? LastName { get; set; }
    public string? RefreshToken { get; set; }
    public DateTime? RefreshTokenExpiryTime { get; set; }
}

public string VerifyHashPasswd(string hashedPassword, string plainPassword)
{
    UserInfo t = new UserInfo();
    var hasher = new Microsoft.AspNetCore.Identity.PasswordHasher<TableUserInfo>();
    var successResult = hasher.VerifyHashedPassword(t, hashedPassword, plainPassword);
    return successResult.ToString();
}

原理说明 #

ASP.NET Core生成的密码哈希包含算法版本、盐值等额外元数据，ASP.NET 4.8原生PasswordHasher无法解析这些信息。通过引入ASP.NET Core Identity的PasswordHasher，可以正确识别并验证该格式的哈希值，从而让C++应用通过ASP.NET 4.8库完成跨框架的密码验证。

内容的提问来源于stack exchange，提问作者user2354396