I hear what you are saying; and it makes sense. However my application applies to such a non-secure business that security hole is not a problem. However, making a customer to do another step (like resetting their password) may piss them off and get me fired :)
Thank you for the suggestion.
>May I suggest that you email a token that allows them to reset their password online? For example, the email will have a link with the token as a parameter (
http://www.mysite/com/resetpwd/734jGkagkjKEW9856kj) The token is generally a guid. Emailing a UID/PWD is a security hole as the data is sent in plain text as is storing the pwd unencrypted.
>
>>Thank you for the link. I will review it. But I abandoned my idea of using a Bootstrap/jQuery modal pop up form and decided in favor of a simple ASP.NET form. The purpose of the pop-up form was for a user to recover his password. That is, he/she would enter their email address and the program would email them their User ID and Password (calling SQL Server database first). Putting such functionality (calling SQL Server and sending email) into a pop-up/modal form turned out to be too complicated. ASP.NET form is much simpler.
"The creative process is nothing but a series of crises." Isaac Bashevis Singer
"My experience is that as soon as people are old enough to know better, they don't know anything at all." Oscar Wilde
"If a nation values anything more than freedom, it will lose its freedom; and the irony of it is that if it is comfort or money that it values more, it will lose that too." W.Somerset Maugham
