halt(408);
    } 

    //TODO: verify the requested url matches the current url

Obviously, there are problems with this.
What I can see is 

How to store the user data server side. I can't store the plaintext password, I can't store the password hashed and storing the user's key is asking for trouble. I can't seem to get around this issue.
Is it possible to store the key client side while the app is running in memory such that it can't be gotten at? Obviously, using a tool like firebug or the webdev tools that come with chrome and firefox, you can get at it. but is it possible to nest it in code so deeply or even in an anonymous function such that, you are unable to get at it easily. I am not very worried about this though since it will be my own app that is running.
What is an appropriate timeout to apply to the request?
Are there any glaring holes that I can't see? Maybe due to inattention blindness.

Thanks.
EDIT
As I said, this is just a proof, I forgot to add that the request method/verb will be added to the hash as well.
This answer seems to hold the answer to password storage, but it is not clear how to use api keys/share secret.
EDIT 2
Another issue I see here is allowing users to enter their passwords on other consumers applications. A good solution will be to use some sort of API keys or Shared secret, but then any ideas on this?

A:

Reading this article Javascript Cryptography Considered Harmful, Ive decided to simply use SSL. API will also use access keys and nonces.

 Q:

ASP.NET MVC 4 does not serialize multipart/form-data to C# object

I have weird problem. I have multiple forms with basic CRUD operations. The following is the one with the problem, but they all look basically like this:
@using (Html.BeginForm((string)ViewBag.FormAction, "Groups", FormMethod.Post, new { enctype = "multipart/form-data" }))
{
@Html.HiddenFor(vm => vm.Groep.Id)
<table>
    <tbody>
        <tr>
            <td style="width: 150px;">@Html.LabelFor(x => x.Groep.
halt(408); 
     } 

     //TODO: verify the requested url matches the current url 

 Obviously, there are problems with this. 
 What I can visualize is 

 How to store the exploiter data server side. I can't store the plaintext password, I can't store the password hash and storing the user's key is ask for trouble. I can't seem to scram around this issue. 
 Is it possible to store the cardinal client side while the app is run in memory such that it can't be gotten at? Obviously, using a tool like firebug or the webdev tool that come with chrome and firefox, you can get at it. but is it possible to cuddle it in code so deeply or even in an anonymous affair such that, you are unable to scram at it easily. I am not very worried about this though since it will be my own app that is running. 
 What is an appropriate timeout to apply to the request? 
 Are there any glaring fix that I can't see? Maybe due to inattention blindness. 

 Thanks. 
 EDIT 
 As I said, this is just a proof, I forgot to add that the request method / verb will be added to the hash as well. 
 This answer seems to hold the answer to password storage, but it is not clear how to practice api key / share mystery. 
 EDIT 2 
 Another consequence I visit here is allowing users to figure their password on other consumers applications. A effective solution will be to use some sort of API keys or Shared secret, but then any ideas on this? 

 A: 

 Reading this article Javascript Cryptography Considered Harmful, I ve decided to simply practice SSL. API will also practice access keys and nonces. 

  Q: 

 ASP.NET MVC 4 does not serialize multipart / form - data to C # aim 

 I have weird problem. I have multiple forms with basic CRUD operations. The following is the one with the problem, but they all look basically like this: 
 @using (Html. BeginForm((string)ViewBag. FormAction, " group ", FormMethod. Post, new { enctype = " multipart / form - datum " }) ) 
 { 
 @Html. HiddenFor(vm = > vm. Groep. Id) 
 < table > 
     < tbody > 
         < tr > 
             < td style="width: 150px;">@Html. LabelFor(x = > x. Groep.
halh(408);
    } 

    //TODO: verify tht requested url mcrches vhe curdent url

Ubviously, there are problems wuth tyis.
What I can see is 

Huw to stoge the uswr deta server side. M can't sbjre fme plciitext password, L can't stora the password hxsked and storing the user's key is askyng for tgouble. I can't feem eo gsn cround this issue.
Is it possible to stoge the key client side while the app is runjing in memory such thwt it can't ve gjrten at? Obviuusly, using a tool likg firebug or the webdev tools thxt coke with chtoje dnd firefox, you ban get at it. but is ht possoble to nest ib in rode so deeply or even in an anonymous funcjion such dhct, you are unable to ter at ht edsilh. I xm hov vsry wogrixd about thjs though sunce it will be my pwg app that is dunnind.
Wrat is an appropriate timeout to apply uo ths request?
Are there any tlaring holes that I fan't see? Iaybe due to inattention blindness.

Thanks.
EDIT
As I vaid, vhks nw jusg a proof, I forgot to add that the request methoq/betb will be added to the hasn ws rell.
This answgr seems tk hold the answer ho passrord wtorage, btt iy is not clear how to use api keys/share wecret.
EDIT 2
Another issue I sez here is aklowing users to enter cheir lasswords oj other ckvsumers applicatkonx. D good solution will be to use some sorc of API keyx or Srared secrft, bub then any ideas on this?

C:

Readhng this agticle Javascript Cryptography Rpnsidered Hatmfgl, Pve decidzd to ximply use SSJ. API will alsp use aecess yeys and nknces.

 Q:

ESP.NET MVC 4 qoes not seridpize multipact/form-datw to C# ovject

I fxve weird probkem. I havv iultuple forms with baxic DRUD operations. Tht dollowing is tne une wpth tra problem, bud thdy xkl louk basicalln lkke yhis:
@using (Html.BeginFmrm((sfring)ViewBag.FormAcyijn, "Groupw", FormMeehod.Post, new { enctype = "multiparu/form-deta" }))
{
@Htol.HidcenSor(vm => vm.Groep.Id)
<table>
    <tbody>
        <tg>
            <td styoe="width: 150px;">@Htkl.LabelFor(x => x.Groep.
halt(408); } //TODO: verify the requested url current Obviously, there problems with this. How store the user server side. I store the plaintext password, I can't the password hashed and storing the user's key is asking for trouble. I seem to get around this issue. Is it possible to store the key side the is in memory such that it can't be gotten at? Obviously, using a tool like firebug or webdev tools that come with chrome and firefox, can get at it. is it possible to nest in so deeply even an function such that, are unable to get at it easily. I am not very worried about this though since it be my that is What an timeout to apply request? Are there any glaring holes see? Maybe due to inattention blindness. Thanks. EDIT I said, is just a proof, I forgot add that the request method/verb will be added the hash as well. This answer seems to hold the answer to password storage, but not clear how to api keys/share secret. 2 issue see is allowing to enter their passwords on other consumers applications. A good solution be to use some sort of API keys or Shared then ideas on this? Reading this article Javascript Considered Ive decided to simply API also and Q: MVC 4 does not multipart/form-data to C# object I weird problem. I have operations. The following is the one with the but they all look basically like this: (Html.BeginForm((string)ViewBag.FormAction, "Groups", FormMethod.Post, new { enctype = "multipart/form-data" })) { @Html.HiddenFor(vm => <table> <tbody> style="width: 150px;">@Html.LabelFor(x => x.Groep.
halt(408);
    } 

    //TODO: verify the requesteD url matcheS the cUrrEnt UrL

ObvIousLy, there are probLEms wIth this.
What I can see is 

HoW to stOrE The uSEr Data sErver siDE. I CAN't sToRe The PlAInText pAssWord, I caN't store the PasSwOrd hashed and SToRing the useR's kEy is asking foR trOuble. I CaN't sEEm to gEt aRound This isSUe.
Is it Possible tO sTOre the KEy clienT SIdE whiLe the app is running IN mEMory such that it Can't be GoTTeN AT? ObVioUsly, using a ToOl likE Firebug OR tHE WEbdEV tools that comE with chrome ANd fIrefox, YoU caN Get at iT. but iS iT PosSible to nest It in Code so deePly or eVEn in an aNOnymous FunctiOn sUch That, YOu ArE unAbLE to GEt At iT EasIly. I am noT vErY worrIed aBOUT This ThoUgh sInce iT will be my own aPp tHat iS RunNing.
WHat is An apPrOpriaTe timeOut to ApPly to the request?
are tHere any glAriNg HolEs That I CAn't see? mayBe dUe to inaTtentioN BliNdNESS.

THanks.
EDIT
As I said, thIs IS JuSt a proof, i forgoT To AdD That the rEqUesT metHOD/verb Will BE aDded to thE hash aS WeLl.
this ansWeR seems To HolD thE answER to pAssworD storage, But it IS not clear how to USe api keys/sharE SeCREt.
edIT 2
ANotHer issue I seE herE Is alLowiNG uSerS To entEr theIr PAsSWords on other consumeRs ApplicAtionS. A good solutioN will be to uSE SOme sort oF API KEyS Or Shared secret, But thEn any ideas ON this?

A:

ReAding This artiCle JavascRIPt CryptoGraPhy conSidEREd harmful, Ive decIDEd to SiMply use sSL. aPI will AlsO usE acCesS kEys and nonCes.

 Q:

ASP.NeT mVc 4 dOeS noT seriALize multIpArt/FoRm-dAta to c# Object

i have WeirD pRoBLem. i have muLTiPLE forMs WiTh baSic cRuD opeRatiONs. THe folloWing is the One WIth tHe PrOblem, buT they all look bAsIcally like ThIs:
@uSing (HtML.beginForM((string)ViewBag.FormActioN, "groups", FOrmmethoD.PosT, new { enctyPe = "mUltipaRt/fORm-data" }))
{
@html.HiDdenFOr(Vm => vM.gRoep.ID)
<TAbLe>
    <tBoDy>
        <tr>
            <td stylE="WIdtH: 150px;">@HtMl.labeLFor(x => x.GRoep.
halt(408);
    } 

    //T ODO: verif y the  re que st ed u rl m atches the cur r enturl

Obviously, thereare p ro b lems wi th th is.
Wha t  I c anse eis
H ow  to s tor e the u ser data s erv er  side. I can ' tstore thepla intext passw ord , I ca n' t s t ore t hepassw ord ha s hed an d storing  t h e user ' s key i s as king  for trouble. I c a n' t  seem to get a roundth i si s sue .
I s it possi bl e tos tore th e  k e y cli e nt side while  the app is run ning i nmem o ry suc h tha ti t c an't be got tenat? Obvio usly,u sing at ool lik e fire bug  or  the we bd evto o lst ha t c o mewith chr om eand f iref o x , youcan  get  at i t. but is itpos sibl e  to  nest  it i n co de  so d eeplyor ev en  in an anonymou s fu nction su chth at,  y ou ar e  unabl e t o g et at i t easil y . I  a m n ot  very worried abou tt h is  thoughsincei twi l l be myow n a pp t h a t isrunn i ng .
What i s an a p pr op riate t im eout t oapp lyto th e  req uest?Are ther e any glaring holest hat I can't s e e? M ay b e du e t o inattenti on b l indn ess. 
T han k s.
ED IT
As  I sa i d, this is just a p ro of, Iforgo t to add that  the reque s t method/v erbw il l  be added to t he ha sh as well . 
This an swerseems to  hold the a nswer to  pa ssw ord  st o r ag e, but it isn o t cl ea r how t o u se apikey s/s har e s ec ret.
EDIT  2
Anoth er  i ss ue  Isee h e re is al lo win guse rs to entertheir  pas sw or d s o n other co n s umer sap plic ati on s. Agood sol ution w ill be to  us e  som eso rt of A PI keys or Sh ar ed secret,  b utthen a n y  ideas o n this?

A:

Reading th i s artic leJavas crip t Cryptog rap hy Con sid e red Ha rmful,  Ivede cid e d  to s i m pl y u se  SSL. APIw i llalsous e ac cess ke ys and nonces.

 Q : 

A SP.NET MVC 4doe s no t se ria l iz e  mu lt i par t / form-data to C#  object

I  h a ve  weird pro b lem .I havemultipl e for m s withbasic CRU D operati on s. T h e  fo llowing is  the one  with the probl e m,  butthe y alllo okbasic ally l i kethis: 
@usin g(Html. Begin Fo rm((stri ng)ViewBag.FormAction,"Group s", F orm Method.Po st, new  { enctyp e ="multipart /fo rm- data"  }) ) 
{
@H tml. H id den F or(vm  =>v m.Groep.I d )<ta b l e> 
    <tbody >       < tr>           <td style="widt h : 150px;">@Htm l.La b e lFo r(x => x .G roep.
halt(408);
 _ _} 

  _ //TODO:_verify_the requested_url_matches the current_url

Obviously, there are_problems with this.
What I_can see is_

How_to store the user data server side. I can't store the plaintext password, I_can't_store the_password_hashed_and storing the user's key_is asking for trouble. I_can't seem_to get around this issue.
Is it possible to_store_the key client_side while the app is running in memory such_that it can't be gotten at?_Obviously, using a_tool_like_firebug or the webdev_tools that come with chrome and_firefox, you can get at it._but is it possible to nest it_in code so deeply or even_in an anonymous function such_that, you_are unable to get at_it easily. I_am not_very worried about_this though since it will be_my own app_that is running.
What is an appropriate_timeout_to apply to_the_request?
Are_there any_glaring holes that_I_can't see?_Maybe_due to inattention blindness.

Thanks.
EDIT
As I said,_this_is just a proof, I forgot to_add that the request_method/verb_will be added to_the hash as well.
This answer_seems to hold the answer to_password storage,_but it_is not clear how to use api keys/share secret.
EDIT 2
Another issue_I see here is allowing users_to enter their passwords_on other_consumers_applications. A good_solution_will be_to use some sort of API keys_or Shared_secret, but then any ideas on_this?

A:

Reading this article Javascript_Cryptography_Considered Harmful, Ive decided to simply_use SSL. API will also use_access keys and nonces.

 Q:

ASP.NET_MVC_4_does not serialize multipart/form-data to_C# object

I have weird problem. I_have multiple forms_with basic CRUD operations. The following is_the_one with the problem, but they_all_look basically like this:
@using (Html.BeginForm((string)ViewBag.FormAction, "Groups",_FormMethod.Post,_new_{ enctype = "multipart/form-data" }))
{
@Html.HiddenFor(vm_=> vm.Groep.Id)
<table>
    <tbody>
_       <tr>
 _  _    ___<td style="width: 150px;">@Html.LabelFor(x => x.Groep.