Persist Password question

[PoppapumpJ]

I am autenticating a web app using the FormsAuthentication.RedirectFromLoginPage method once I validate my username/password combo.

To invoke transactions from an API throughout my app, I must pass along the username and password.

I can pull my user name from user.identity.name with no problem.

Is there are better solution to persisting the password than using a session variable or creating a custom provider?

Is there a way to extend the user.identity object to include something like user.identity.password?

Thanks.

 

[jmeckley]

you shouldn't keep the password around any longer than necessary. get the pwd text, hash it save to the database. if it's valid allow them into the site, if not fail. but once their authenticated you do not need the password.

Jason Meckley
Programmer
Specialty Bakers, Inc.