title: Authenticating username and password using Session
body: <p>I looked around here on stackoverflow, as well Google, but was not able to find an answer that pertained to my problem, so i'm posting it here.</p>
  
  <p>I have a login page where the user is directed to input their username and password, which are both stored in a MySQL database. The username is stored as plain text and the password is hashed (using the CrackStation - <a href="https://crackstation.net/hashing-security.htm#aspsourcecode" rel="nofollow">https://crackstation.net/hashing-security.htm#aspsourcecode</a>) and the hash is stored in the database. I am able to successfully have the user login one time using the username and password, but I would like to use SESSION so that the user can navigate around the website and not have to login each time they go to a different page. I was easily able to use SESSION in my test environment because the password was stored as plain text, but now with the password being hashed i'm not able to get the Session to work in my code. So I wanted to know what can I do to get the password to validate in SESSION.</p>
  
  <p>My code that I am using on my login page is the following:</p>
  
  <pre><code>protected void Page_Load(object sender, EventArgs e)
  {
      try
      {
          admin = Convert.ToInt16(Request.QueryString["Admin"]);               
          Instructor = Convert.ToInt16(Request.QueryString["Inst"]);               
  
          if (Session["username"] == null || (string)(Session["username"]) == "")
          {                   
              token = Request.QueryString["tokenNumber"];
  
              lblUsername.Visible = true;
              txtUsername.Visible = true;
              lblPassword.Visible = true;
              txtPassword.Visible = true;
              btnlogin.Visible = true;
          }
  
          else if (Session["username"] != null || (string)(Session["username"]) != "")
          {                   
              username = (string)Session["username"];
              userType = (string)Session["userType"];
              pass = (string)Session["password"];                   
  
              if (userType == "Participant")
              {                       
                  Response.Redirect("/srls/StudentUser");
              }
              else if (userType == "Coordinator")
              {
                  Response.Redirect("/srls/CoordinatorUser");                       
              }
              else if (userType == "Instructor")
              {
                  Response.Redirect("/srls/InstructorUser");
              }
          }
  
  
      }
      catch (Exception exc) //Module failed to load
      {
          Exceptions.ProcessModuleLoadException(this, exc);
      }
  }
  
  protected void btnlogin_Click(object sender, System.EventArgs e)
  {
      char activation;
  
      if (Request.QueryString["tokenNum"] != null)
      {
          using (OdbcConnection dbConnection = new OdbcConnection(srlsConnStr))
          {
              dbConnection.Open();
              {
                  OdbcCommand dbCommand = new OdbcCommand();
                  dbCommand.Connection = dbConnection;
                  dbCommand.CommandText = @"SELECT tokenNum FROM srlslogin WHERE user_email_pk = ?";
                  dbCommand.Parameters.AddWithValue("@user_email_pk", txtUsername.Text);
                  dbCommand.ExecuteNonQuery();
  
                  OdbcDataReader dataReader = dbCommand.ExecuteReader();
                  while (dataReader.Read())
                  {
                      if (token == dataReader["tokenNum"].ToString())
                      {
                          updateActivationStatus(txtUsername.Text);
                          LoginWithPasswordHashFunction();
                      }
                      else
                      {
                          test.Text = "You are not authorized to login! Please activate your account following the activation link sent to your email " + txtUsername.Text + " !";
                      }
                  }
              }
              dbConnection.Close();
          }
  
      }
      else if (Request.QueryString["tokenNum"] == null)
      {
          using (OdbcConnection dbConnection = new OdbcConnection(srlsConnStr))
          {
              dbConnection.Open();
              {
                  OdbcCommand dbCommand1 = new OdbcCommand();
                  dbCommand1.Connection = dbConnection;
                  dbCommand1.CommandText = @"SELECT * FROM srlslogin WHERE user_email_pk = ?;";
  
                  dbCommand1.Parameters.AddWithValue("@user_email_pk", txtUsername.Text);
                  dbCommand1.ExecuteNonQuery();
  
                  OdbcDataReader dataReader1 = dbCommand1.ExecuteReader();
                  if (dataReader1.Read())
                  {
                      activation = Convert.ToChar(dataReader1["activation_status"]);
                      if (activation == 'Y')
                      {
                          activation status, activation == Y";
                          LoginWithPasswordHashFunction();
                      }
                      else
                      {
                          lblMessage.Text = "Please activate your account following the Activation link emailed to you at &lt;i&gt;" + txtUsername.Text + "&lt;/i&gt; to Continue!";
                      }
                  }
                  else
                  {
                      lblMessage.Text = "Invalid Username or Password";
                  }
                  dataReader1.Close();
              }
              dbConnection.Close();
          }
      }
  }
  
  private void LoginWithPasswordHashFunction()
  {
      List&lt;string&gt; salthashList = null;
      List&lt;string&gt; usernameList = null;
  
      try
      {
          using (OdbcConnection dbConnection = new OdbcConnection(srlsConnStr))
          {
              dbConnection.Open();
              {
                  OdbcCommand dbCommand = new OdbcCommand();
                  dbCommand.Connection = dbConnection;
                  dbCommand.CommandText = @"SELECT slowhashsalt, user_email_pk FROM srlslogin WHERE user_email_pk = ?;";
  
                  dbCommand.Parameters.AddWithValue(@"user_email_pk", txtUsername.Text);
                  OdbcDataReader dataReader = dbCommand.ExecuteReader();
                  while (dataReader.HasRows &amp;&amp; dataReader.Read())
                  {
                      if (salthashList == null)
                      {
                          salthashList = new List&lt;string&gt;();
                          usernameList = new List&lt;string&gt;();
                      }
  
                      string saltHashes = dataReader.GetString(dataReader.GetOrdinal("slowhashsalt"));
                      salthashList.Add(saltHashes);
  
                      string userInfo = dataReader.GetString(dataReader.GetOrdinal("user_email_pk"));
  
                      usernameList.Add(userInfo);
                  }
  
                  dataReader.Close();
  
                  if (salthashList != null)
                  {
  
                      for (int i = 0; i &lt; salthashList.Count; i++)
                      {
                          bool validUser = PasswordHash.ValidatePassword(txtPassword.Text, salthashList[i]);
                          if (validUser == true)
                          {                                    
                              Session["user_email_pk"] = usernameList[i];
  
                              OdbcCommand dbCommand1 = new OdbcCommand();
                              dbCommand1.Connection = dbConnection;
                              dbCommand1.CommandText = @"SELECT user_status FROM srlslogin WHERE user_email_pk = ?;";
  
                              dbCommand1.Parameters.AddWithValue("@user_email_pk", txtUsername.Text);
                              dbCommand1.ExecuteNonQuery();
  
                              OdbcDataReader dataReader1 = dbCommand1.ExecuteReader();
                              while (dataReader1.Read())
                              {
                                  user_status = dataReader1["user_status"].ToString();
                                  Session["userType"] = user_status;
                              }
  
                              Response.BufferOutput = true;
  
                              if (user_status == "Participant")
                              {
                                  Response.Redirect("/srls/StudentUser", false);
                              }
                              else if (user_status == "Coordinator")
                              {
                                  Response.Redirect("/srls/CoordinatorUser", false);
                              }
                              else if (user_status == "Instructor")
                              {
                                  Response.Redirect("/srls/InstructorUser", false);
                              }
  
                              dataReader1.Close();
                  Response.Redirect(/srls/StudentUser) - Goes to Login Page";
                          }
                          else
                          {
                              lblMessage.Text = "Invalid Username or Password! Please Try Again!";
                          }
                      }
                  }
              }
              dbConnection.Close();
          }
      }
      catch (Exception ex)
      {
  
      }
  </code></pre>