Password Fields and Postbacks

[dwa]

All,

We're trying to determine how to deal with password fields losing their
state on a post back.

We've got a form that implements post backs to carry out server side
processing. As a result of the post back, passwords entered by the user
lose their values and the user gets an error message upon final validation
when they submit. Here's an illustration:

1. Password : [ ]

2. Confirm: [ ]

3. Select something from a list: [ ]
// this could cause a post-back, which wipes out the passwords

4. Some other field: [ ]

5. Hit submit key

After hitting the submit key (5), the user gets an error message, because
the passwords are now blank as a result of the post back in step #3. What
techniques should be used to get around this? We've tried fiddling with
the VIEWSTATE, to remember values, but it seems like their should be better
way... (?)

-- dwa

[Kevin Spencer]

There is a reason why passwords don't survive postbacks, and it's built into
the browser. In fact, if you enter a password into a password field in any
HTML form, navigate away from it, and return to the page using the Back
button, the form fields will all have their values, EXCEPT for the password
fields. Why? To prevent anyone from stealing another person's password by
doing so. Even if you manage to circumvent this, and I can think of one or
two ways you might, are you sure you want to abandon the security that this
affords, which all browser manufacturers seem to think is extremely
important?

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
Big things are made up
of lots of little things.

"dwa" <[e-mail] > wrote in message
news:ea******** ******@TK2MSFTN GP11.phx.gbl...

All,

We're trying to determine how to deal with password fields losing their
state on a post back.

We've got a form that implements post backs to carry out server side
processing. As a result of the post back, passwords entered by the user
lose their values and the user gets an error message upon final validation
when they submit. Here's an illustration:

1. Password : [ ]

2. Confirm: [ ]

3. Select something from a list: [ ]
// this could cause a post-back, which wipes out the passwords

4. Some other field: [ ]

5. Hit submit key

After hitting the submit key (5), the user gets an error message, because
the passwords are now blank as a result of the post back in step #3. What
techniques should be used to get around this? We've tried fiddling with
the VIEWSTATE, to remember values, but it seems like their should be better way... (?)

-- dwa