WAP, CreateUserWizard, send password by email

Question

Please note I'm totally new to ASP.NET..

How can I have the username, password and other profile details sent by email to a site admin on new user registration?

I'm a bit at a loss on how the CreateUserWizard works, if the password field is at all available in code? Would I need to override some method, and where can I view the actual code of the Register class?

Answer 1

Well, there is an event OnCreatedUser that is fired when the user is created.

This you can handle. I do not think the password is actually availabe (anyway like other people wrote you do not want that in the email to your admin). However the rest of the data you can eMail from this event to your admin.

I do something similar here

  protected void CreateUserWizard1_CreatedUser(object sender, EventArgs e)
  {
  CreateUserWizard cuw = (CreateUserWizard) LoginView1.FindControl("CreateUserWizard1");
  MailUtility.SendMessage(cuw.Email, cuw.UserName);

Actually in this code cuw.Password is available, so you might even have access to the password. But once again I advise you against mailing the password.

Answer 2

Sending the password of a user to someone else is very bad from a security perspective. People tend to use the same password for different sites, so the password should never be exposed. The ASP.NET Membership provider actually uses a one-way hash algorithm to make password retrieval impossible, even with access to the database.

In Sweden, there have been a recent case where many journalists, members of parliament and other official people had their e-mail read by external people after a popular blogging site was hacked. Those having a blogging account with the same password as their email were easy targets.

There is a CreatedUser event on the CreateUserWizard control that can be used to execute own code when a user is created.