PasswordBox binding in MVVM

Question

A problem with binding to a PasswordBox, it's a security risk but I am using the MVVM pattern I found some interesting code here

http://www.wpftutorial.net/PasswordBox.html

I basically have properties in my LoginViewModel for Username and Password. Username is fine and is working as it's a TextBox.

I used the code above as stated and entered this

<PasswordBox ff:PasswordHelper.Attach="True"
ff:PasswordHelper.Password="{Binding Path=Password}" Width="130"/>

When I had the PasswordBox as a TextBox and Binding Path=Password then the property in my LoginViewModel was updated.

My code is very simple, basically I have a Command for my Button. When I press it CanLogin is called and if it returns true it calls Login. You can see I check my property for Username here which works great.

In Login I send along to my service a Username and Password, Username contains data from my View but Password is Null|Empty

<TextBox Text="{Binding Path=Username, UpdateSourceTrigger=PropertyChanged}"
     MinWidth="180" />

<PasswordBox ff:PasswordHelper.Attach="True" 
         ff:PasswordHelper.Password="{Binding Path=Password}" Width="130"/>

I have my TextBox, this is no problem, but in my ViewModel the Password is empty.

I put a breakpoint and sure enough the code enter the static helper class but it never updates my Password in my ViewModel

Sheridan Sheridan · Accepted Answer · 2014-01-20T10:49:28

Please stop what you are trying to do, as passing unencrypted passwords around an application is a terrible security risk. You should be logging in your users like this:

Provide Username and Password input fields for them as you have, but the value for the password should be encrypted immediately. Your database should store these encrypted passwords only. So to verify whether a user has entered the correct password or not, you simply compare the values of the encrypted passwords.

Therefore, you don't need to pass the value of the user password field to the database to check it... you need to pass the encrypted password value from the database to the view model.

PasswordBox binding in MVVM

2 Answers