Read/Write vB Cookie with ASP

[jmottle]

Does anyone know how to read and write the vB cookie with ASP. I've read tons of threads, but all are PHP based.

Cheers,
Jeff

[Dismounted]

What do you need to know about them exactly? Or what are you going to do with them?

[jmottle]

Thanks for your reply.

I am redoing our site and currently have several different login and member base systems and would like to use the vB user database as the only one to validate access to the forums as well as certain pages within our site.

I need to program a way to read and write the vB cookie to preserve the login. So there are a few questions I have.

1. I looked in the cookie and am able to read 'bbuserid' and 'bbpassword', so I am at least able to pull these values out to compare to a DB recordset. I am however unclear on the syntax and usage to compare MD5 hashes, which is what I assume is the value for 'bbpassword' in the cookie.

2. When someone checks 'remember me', do the vB pages do a database lookup and compare it to the cookie each time a vB page is accessed?

3. How to a write the MD5 password hash in ASP when a user first logs in so I can compare it to the database. I read something about the 'salt' column in the table, but was unclear how this works.

Cheers,
Jeff

[Dismounted]

The password is md5'd. The salt field is then added onto the end of the hash, and then it is md5'd again.

[Paul M]

Does ASP have an MD5 function ?

[ragtek]

try this:

<script runat="server">
   Function HashMD5(strText As String) As String

      If strText = Nothing Then strText = ""

      HashMD5 = System.Web.Security.FormsAuthentication. _
         HashPasswordForStoringInConfigFile(strText, "md5")

   End Function

strText = Request.QueryString("text")
   strHash = HashMD5(strText)

</script>

[jmottle]

Thanks for the additional info!

I am seeing an odd problem though. I've used MD5 and the salt with a known password and it matched the hash in the database, but the cookie that vB writes has a different hash in the bbpassword field, yet the login works fine. How is this?

[Dismounted]

The password cookie is the normal database hash, with the license number appended to the end and md5'd again.

[jmottle]

ok, got it. Thanks.

Once last question I think. I see there is a session table in the database as well. Is this validated against when navigating and posting in the forum or is it only used when the user has elected not to have a persistant cookie login? If I need to use this, how does it work and how are 'sessionhash' and 'idhash' used?