From 4721a70ea72bc5337bfd152309524f6802c51f98 Mon Sep 17 00:00:00 2001
From: Garrritt McCune <glmccune@gmail.com>
Date: Tue, 12 Jan 2021 21:28:11 -0600
Subject: [PATCH] Updated the PasswordManager to check for a min password
 length as that might be a tad important.

---
 .vs/SecureCore/v16/.suo                      | Bin 67584 -> 67584 bytes
 SecureCore/Authentication/PasswordManager.cs |   4 +++-
 SecureCore/Controllers/AuthController.cs     |  14 ++++++--------
 SecureCore/Services/UserDataService.cs       |   4 ++--
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.vs/SecureCore/v16/.suo b/.vs/SecureCore/v16/.suo
index 342ce739cbb713d7c1be19a57e9606831757587c..f2d8eb63d6f5a26505e6c317866ed8aa5de02a4e 100644
GIT binary patch
delta 774
zcmZpez|t^*WrBe$69W_oFfi~jFfcGPFfjc4|NlQolzF4CJQM2z{)@*$HWxDeW)v)D
zU|^7DU|?WjU|{(F|NsAz$+axfjD?eDvdA-*Pu|Ir&X_$}k+s?~3n~v%12Qa!fq@~H
zfq@~9fq@~Pfq|ibfq_Adfq|ijfq_Anfq_Aufq|ivfq|iH@<LASNlZDc2fnmC4B1@B
zcAhcPmVtpmnSp^p4r-=20|Ns;0|SE+0|NsW0|P@N0|SEs0|NsG0|P@e)O{d(1sNC^
zVi*`0^q~5r7#JA185kIN85kJU85kHMC(q=N=geeaU@&E1V9=NtC@g3RRSMD$!oicT
za;P)9P3Gma)&zMYgn@w}l!1XEjDdk6oPmKM0_u$@ByYq{F67i_m1JOGkeC=4y@~6H
z^yDL<Hj~tjOg@tGfAeAWjV!FrAfIlo)M;m4WX80}h-Hx-)8tEQ)F%7wlGto#afo%1
z8`B~OwoPS+StlR%_F%DaGO*mt?~^IRShl$`qn&$lQ;x%ChmHe`o65L3SX_-PjW_ex
zedJ^;+sxSapK(za%c6ZOi#nK~{7o~oc*NL1u?fW*3=9mX85kH`_D_B|r*`w+C60_-
zh71f0J|MA8AhF34W|(c>y=*%pW58s`IYyH|%;lNv8Y9T0<&VsroI1~05|mn?<}!dH
zrjmhyfd`a|CMz-tPv)5|G<n9#jL8SCvMgF9vgsWo(`LqfngZlG$CYu@l_C~`PLfA<
dk~sqdgAvS05O+>4z23cOmB^xZY>PgL0RT)G-QEBI

delta 812
zcmZpez|t^*WrD%vf?!S&0R{$H1_lOZ1_p+I|NsAIU|?Wi+~_OM#Olz~`YT{_A=7V0
z!4d`r25ANc1{MYehX4Qn|1X_f%OcHKG<hbAJY&V=oh<2$Ig=Gxs~xhT@*p)J3^Fj6
zfq@~9fq@~Pfq|ibfq|irfq_Adfq|izfq_Anfq_Aufq|infq|i%fq`N20#21lOgXFt
z&x>ydY%XLw&lqXRz`&r)z`&pcHCl>+fq|cafkB*sfkBRefuWIsfkA<Rfq{#GfguL!
zOpw(a3=9mh3=9l<P<?_73=G^13=F&s3=HZF3=C0|XL87MW-%}@m@+UhXiN+gW^|tX
zltX=DfdFI3WL{2dj$mkrOb(D2;RU%k8s_53g`D~<nGpBJY~ng1%>nX=C`dp)R&lZc
z6Z_;Zsux&XKmz@-I+NsBHvdqoVP$n=U|=ZST&dH}Jju<2MHnOvRS!~9;nu;p$cSZ;
z0n_A5tJEg@?U2}PXK{#ikr~q>2ew6aOq)EoSy+smP0cs+`((;6mTs=hXy;y3!?dZ4
zn}fy8+|6_|f89sUMI}s&x>y)XH#2tpXPmr$qV#6zzNd_fN|<0m8|Ni#PB?IiR}2(l
zpx9<$Fg^eZ5fIyD|Kx|WYB%p)<jBY+!@$7M$-uzivI!(MdBQZa&AXRuXJquB>^RG4
z@`u?xlU-v3QF)V7=Qt~XQWD545Y_<^3=9lB&=dyZPA**9y=aBVrhQrhM7bdx-3_jc
zi{7wJx>kg0H!6=fmt0)qJNZ={-{cD`4K}S{6q~$%l_e<LC)-(QZLYc0!o28<2mp`q
B<yZg!

diff --git a/SecureCore/Authentication/PasswordManager.cs b/SecureCore/Authentication/PasswordManager.cs
index 702a4a2..ff58a33 100644
--- a/SecureCore/Authentication/PasswordManager.cs
+++ b/SecureCore/Authentication/PasswordManager.cs
@@ -20,6 +20,7 @@ namespace SecureCore.Authentication
         //allowing passwords that are too long can result in a denial-of-service attack. So we must enforce password length limits.
         //The recommended length is between 64 and 128, so I decided to go for the upper bounds.
         public static int MaxPasswordLength { get; } = 128;
+        public static int MinPasswordLength { get; } = 16;
 
         public PasswordManager()
         {
@@ -36,7 +37,8 @@ namespace SecureCore.Authentication
 
         public static (bool IsValid, string Message) PasswordIsValid(string password, string salt, string passwordHash)
         {
-            if (password.Length > MaxPasswordLength) return (false, $"Password length exceeds {MaxPasswordLength} characters.");
+            if (password.Length < MinPasswordLength) return (false, $"Your password is too short, it must be at least {MinPasswordLength} characters long and not exceed {MaxPasswordLength} characters.");
+            if (password.Length > MaxPasswordLength) return (false, $"Your password is too long, it must not exceed {MaxPasswordLength} characters and must contain at least {MinPasswordLength} characters.");
 
             var saltBytes = Convert.FromBase64String(salt);
 
diff --git a/SecureCore/Controllers/AuthController.cs b/SecureCore/Controllers/AuthController.cs
index fbbd3b0..81b0a63 100644
--- a/SecureCore/Controllers/AuthController.cs
+++ b/SecureCore/Controllers/AuthController.cs
@@ -22,17 +22,15 @@ namespace SecureCore.Controllers
             //NOTE: password length should be at most 64 - 128 characters long.
             //Very the user has login data.
             //if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds");
-            if (info.Password.Length > PasswordManager.MaxPasswordLength) return Unauthorized($"Password exceeds maxium length of {PasswordManager.MaxPasswordLength} characters.");
-
             var result = UserDataService.UserNameIsValid(info.UserName);
 
             if (!result.IsValid) return Unauthorized(result.Message);
 
-            if (HttpContext.Request.Cookies.ContainsKey("Session"))
-            {
-                if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName))
-                    return Ok($"Session is live{Environment.NewLine}");
-            }
+            //if (HttpContext.Request.Cookies.ContainsKey("Session"))
+            //{
+            //    if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName))
+            //        return Ok($"Session is live{Environment.NewLine}");
+            //}
 
             var (password, salt) = UserDataService.GetUserPasswordHash(info.UserName);
             var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
@@ -53,7 +51,7 @@ namespace SecureCore.Controllers
             }
             else
             {
-                return Unauthorized();
+                return Unauthorized(result.Message);
             }
         }
 
diff --git a/SecureCore/Services/UserDataService.cs b/SecureCore/Services/UserDataService.cs
index 3a54b1e..59dabb1 100644
--- a/SecureCore/Services/UserDataService.cs
+++ b/SecureCore/Services/UserDataService.cs
@@ -37,7 +37,7 @@ namespace SecureCore.Services
 
             using(var connection = new SqlConnection(ConnectionString))
             {
-                using(var command = new SqlCommand("SELECT [Password Hash], [Salt Hash] FROM Login WHERE [User Key] = @UserId", connection))
+                using(var command = new SqlCommand("SELECT [Password Hash], [Salt] FROM Login WHERE [User Key] = @UserId", connection))
                 {
                     command.Parameters.AddWithValue("UserId", userId);
 
@@ -47,7 +47,7 @@ namespace SecureCore.Services
 
                     reader.Read();
 
-                    return (reader["Password Hash"].ToString(), reader["Salt Hash"].ToString());
+                    return (reader["Password Hash"].ToString(), reader["Salt"].ToString());
                 }
             }
         }