用户名/密码数据库检查

Question

如何改进此用户名/密码检查？

    [AcceptVerbs(HttpVerbs.Post)]
    public ActionResult Login(FormCollection collection)
    {
        var users =
            (from p in _dataContext.Users
            where p.Name == collection["Username"] && p.Password == collection["Password"]
             select p);

        if (users.Count() > 0)
        {
            // Login Succeed
            // To get the username I should do something like users.First().Name
            // and that's really bad...

            return RedirectToAction("Login");
        }
        else
        {
            // Login Faild
            return View();
        }
    }

Answer 1

您是否考虑过Microsoft的会员API？它以安全的方式为您处理用户名和密码的所有详细信息.此外,您似乎计划以明文形式存储密码,这在密码学领域是一个重要的罪过.