title: ASP Classic user login system password security considerations?
body: <p>All,</p>
  
  <p>I'm currently designing a user account system in ASP classic...don't judge, it's what I'm comfortable with ;).  I have several of the components built already, including the UI, database table, CRUD database ASP pages and a generic mailer.  I'm curious as to some of the best practices for implementing secure login systems for ASP.  Searching the web yields a ton of "simple ASP security" solutions, which I've used before, but this is my first time time building a robust and truly secure solution.  The final implementation will be used for a job application system, so it definitely needs to be secure due to the content.</p>
  
  <p>So far, I have:</p>
  
  <ul>
  <li>Password recovery/reset goes only to the e-mail account on file</li>
  <li>Hash stored passwords in the database</li>
  <li>Do not set an expiration on session cookies so they are only stored in memory (read this somewhere today)</li>
  <li>Get a certificate for the server and use https</li>
  </ul>
  
  <p>A couple general questions that I have...</p>
  
  <ol>
  <li><p>Submitting the password in a form passes it through the query string.  Do I need to hash this somehow prior to submitting the form?</p></li>
  <li><p>On a related note...  If I am using https, since it is already secure, can I do the hash on the ASP page that handles the write to the database?  I'm using AJAX to parse the query string from the sending form and pass it to the ASP page which connects to the database and does the CRUD operations.</p></li>
  </ol>