email in asp.net

Question

Possible Duplicate:
sending to an email with contact form asp.net

How to send email from ASP.NET page using C# as for forget password, password will be automatically emailed to the alternate id. I need how is it possible to send email from ASP.NET page using C#.

Answer 1

You could use the SmtpClient class to send an email in a .NET application.

Answer 2

What you are suggesting sounds like a security risk. It is inadvisable to send a password through email, since this assumes your are storing the plain text password somewhere. Since you should only know the salted hash of the password, you probably want to make the user reset their password instead.

I suppose if you still have some reason to send an email you can check out an extensive tutorial here to start. Seriously though, You can compromise all of your users security if you are not hashing there passwords, and even more so if you are emailing them out.

Answer 3

There is no shortage of articles and tutorials on this.

Side note: Being able to email the user their password implies that you're storing their password in plain text. Please, please don't do that. Passwords should be stored in an encrypted form. If the user forgets their password, email them a temporary link for them to reset their password.

Answer 4

The short answer is, as stated above (+1'd btw), to use the SmtpClient class.

However, it's dangerous to go emailing passwords around. As a rule of thumb:

• Don't send passwords in clear text
• Don't store passwords in clear text

When storing a password (if you don't have some framework that does all this for you)

• Create a salt
• Append the salt to the password
• Hash the resulting string
• Store the salt and resulting hash
• Discard the password
• When authenticating, add the salt to the newly provided password, hash the resulting string, and compare to your stored hash

If a user has forgotten their password, send that user an email containing a one-time use, time-sensitive (expires in 1 hour?), unique-link to reset his/her password. It's also a good practice to require the user to manually provide his/her account name or other identifying criteria on the password-reset form.