C# .NET - How and Where to store password in Windows application?

Asked By Tejaswini Prashant J on 18-Sep-09 07:14 AM

Hi,
     On a login form of a windows application, I want to give the facility to Save Password.
     As in a web application we can save in cookies...Where I can save in case of windows application.. and How?

store password in Windows application

Sagar P replied to Tejaswini Prashant J on 18-Sep-09 07:35 AM

THere is no facility to use COOKIES in windows application to store data. Rather you can use Application Settings to store your uses password;

see these links for same;

You can use application setting to persist user information.

http://www.devx.com/dotnet/Article/34273http://msdn.microsoft.com/en-us/library/8eyb2ct1.aspx
Also another way is to store information in XML file, and retrive data from xml file.

i think this is a best way to solve your problem.

http://www.programminghelp.com/programming/dotnet/working-with-xml-in-windows-forms-application-in-c-part-1/

http://www.dotnetspider.com/forum/182793-write-xml-c-windows-application.aspx


password in Windows application

PRR PRR replied to Tejaswini Prashant J on 18-Sep-09 07:47 AM
Firstly you would never store sensitive information in cookies. That is a wrong approach. Regarding Win forms application you can store them (after hashing them) in database and compare the hash. Have a login form with username and password fields. Also you can look into  http://msdn.microsoft.com/en-us/library/system.security.principal.genericidentity.aspx and http://msdn.microsoft.com/en-us/library/system.security.principal.genericprincipal.aspx

Try this approach.

[)ia6l0 iii replied to Tejaswini Prashant J on 18-Sep-09 11:03 AM
After a valid login with your current approach, encrypt the password using any of your algorithms or use the System.Cryptography class in .Net, store it in a place of the application feasilibility. 

If you are sure that the user who uses your application has administrator priveleges, then look at Registry. If not look at  storing the password in a flat file in the user's application data folder. You can access it thru the following snippet:
Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) 

Again, encryption is your choice. Storing the password in the user's application data folder gives you certain security already.

So after your form loads, and the user enters the "username" , on tab out of the textbox, you need to call a function that would return the saved password from the registry/ flat file. 

And then leave it to the user to control the flow.