I have an ASP.Net 4.0 application that is using Forms
Authentication and ActiveDirectoryMembershipProvider. It authenticates
against Active Directory running on Windows Server 2008 R2.
I use ChangePassword control for changing passwords.
When the user changes the password he can log on for some time with
the old password. My client feels this is a security problem with the
application. Is there any way to make sure the old password does not
work after the user changes it?
Also, if I do iisreset on the web server, the old password stops working. The password must be cached somewhere in the web app.
...
Go to the complete details ...