PasswordRecovery Class

The PasswordRecovery control assists users who have forgotten their passwords. It enables a user to request an e-mail message containing either a new password or the password already associated with his or her user name.

Note
The PasswordRecovery Web control uses Internet e-mail services to send recovered or new passwords to users. There are inherent security risks with sending passwords in e-mail. You should determine whether these security risks are acceptable to your site.

Note
If you are not familiar with the set of login controls available in ASP.NET, see ASP.NET Login Controls Overview before continuing. For a list of other topics related to login controls and membership, see Managing Users by Using Membership.

Users can recover passwords only when the membership provider defined in the MembershipProvider property supports clear text or encrypted passwords. Because hashed passwords cannot be recovered, users at sites that use hashed passwords can only reset their passwords.

Security Note

Accepting user input is a potential security threat. Malicious users can send data that is intended to expose vulnerabilities or run programs that try generated passwords. To improve security when working with user input, you should use the validation features of your control and secure any data providers that are configured for your control. For more information, see Securing Login Controls, Basic Security Practices for Web Applications, and Securing Membership.

Note
The PasswordRecovery control can be used when a membership user has not been approved (MembershipUser.IsApproved is set to false), but it cannot be used when a membership user has been locked out (MembershipUser.IsLockedOut is set to true).

The e-mail message is sent using the MailDefinition class. To be able to send e-mail to users, you must configure a mail server in your application's Web.config file. You can change the content of the e-mail sent to users by setting a custom message in the MailDefinition property.

Note
It is not possible to guarantee that a user will receive or view an e-mail message. To verify that a user has received a notification by e-mail, consider providing a confirmation link in the message, allowing the user to confirm that the notification was received.

The PasswordRecovery control has three states, or views:

• UserName view -- Asks the user for his or her registered user name.

• Question view -- Requires the user to provide the answer to a stored question to reset the password.

• Success view -- Tells the user whether the password recovery or reset was successful.

The PasswordRecovery control displays the Question view only when the membership provider defined in the MembershipProvider property supports password question and answer.

The following table lists each style property of the PasswordRecovery control and indicates which view it affects.

You can use an extensive set of style properties to customize the appearance of the PasswordRecovery control. Alternatively, you can apply custom templates to the three views if you need complete control over the appearance of the control. You can use the QuestionTemplate, SuccessTemplate and UserNameTemplate properties to create templates for these views. If you define a template for a view, the style properties of PasswordRecovery have no effect.

The following table lists the PasswordRecovery control style properties and explains which UI element each style property affects. For a list of which properties each style applies to, see the documentation for the individual style properties.

The following table lists which template properties apply to each view in the PasswordRecovery control. For a list of the controls that you must set in each template, see the documentation for the individual template properties.

When the PasswordRecovery control is not customized with templates, the AccessKey property of the PasswordRecovery control applies to the first text box in the control and the TabIndex property, which is applied to all text boxes of the control. If the PasswordRecovery control is customized with templates, then the AccessKey property and the TabIndex property are ignored. In this case, set the AccessKey property and the TabIndex property of each template child control directly.

PasswordRecovery control properties represented by text boxes, such as Answer and Question, are accessible during all phases of the page life cycle. The control will pick up any changes made by the end user by means of the TextChanged event triggered by the textboxes.

The PasswordRecovery control creates a validation group for all required field validators in the control so that other input controls on the page are not affected by validating the PasswordRecovery control. By default, the ID property of the PasswordRecovery control is used as the name of the validation group. For example, a PasswordRecovery control with the ID "PasswordRecovery1" will use a validation group name of "PasswordRecovery1". If you want the PasswordRecovery control to participate in another validation group, you must template the control.

The PasswordRecovery control lets you specify CSS style rules in markup. If you use templates to customize the appearance of the PasswordRecovery control, you can specify CSS styles in the markup in the templates. In that case, no extra outer table is required. You can prevent the table from being rendered by setting the RenderOuterTable property to false.

For information about how to configure this control so that it generates markup that conforms to accessibility standards, see Accessibility in Visual Studio and ASP.NET and ASP.NET Controls and Accessibility.