PasswordHasher Always Fails Validation

Question

User-1156750444 posted

Hi,

I'm implementing a policy where passwords cannot be reused and have the structure in place, however I'm trying to work out how to check this against the PasswordHasher, I always get a failed match.

I've overridden the ChangePasswordAsync method in the ApplicationUserManager as follows, newPassword is passed in as plain text, hashed and then I attempt to verify against the previous entries.

public override async Task<IdentityResult> ChangePasswordAsync(string userId, string currentPassword, string newPassword)
        {
            var hashedPassword = PasswordHasher.HashPassword(newPassword);

            using (var databaseContext = new ApplicationDbContext())
            {
                var history = databaseContext.PasswordHistories.OrderBy(h => h.PasswordCreated).Where(h => h.ApplicationUserId == userId).ToList();

                foreach (var passwordHistory in history)
                {
                    var pwResult = PasswordHasher.VerifyHashedPassword(passwordHistory.PasswordHash, hashedPassword);
                }

                if (history.Select(h => h.PasswordHash).Any(p => PasswordHasher.VerifyHashedPassword(p, hashedPassword) == PasswordVerificationResult.Success))
                {
                    return new IdentityResult("Password must be different from the previous 12 used passwords");
                }
                //Omitted for simplicity
            }                       
        }

I thought I might be doing something stupid until I ran a very simple test in the immediate window which consistently returns Failed.

PasswordHasher.VerifyHashedPassword(PasswordHasher.HashPassword(newPassword), PasswordHasher.HashPassword(newPassword))

Any ideas?

Thanks

Stuart