Updated the PasswordManager to check for a min password length as that might be a tad important.

SecureCore/Authentication/PasswordManager.cs

@@ -20,6 +20,7 @@ namespace SecureCore.Authentication
         //allowing passwords that are too long can result in a denial-of-service attack. So we must enforce password length limits.
         //The recommended length is between 64 and 128, so I decided to go for the upper bounds.
         public static int MaxPasswordLength { get; } = 128;
+        public static int MinPasswordLength { get; } = 16;
 
         public PasswordManager()
         {
@@ -36,7 +37,8 @@ namespace SecureCore.Authentication
 
         public static (bool IsValid, string Message) PasswordIsValid(string password, string salt, string passwordHash)
         {
-            if (password.Length > MaxPasswordLength) return (false, $"Password length exceeds {MaxPasswordLength} characters.");
+            if (password.Length < MinPasswordLength) return (false, $"Your password is too short, it must be at least {MinPasswordLength} characters long and not exceed {MaxPasswordLength} characters.");
+            if (password.Length > MaxPasswordLength) return (false, $"Your password is too long, it must not exceed {MaxPasswordLength} characters and must contain at least {MinPasswordLength} characters.");
 
             var saltBytes = Convert.FromBase64String(salt);
 

SecureCore/Controllers/AuthController.cs

@@ -22,17 +22,15 @@ namespace SecureCore.Controllers
             //NOTE: password length should be at most 64 - 128 characters long.
             //Very the user has login data.
             //if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds");
-            if (info.Password.Length > PasswordManager.MaxPasswordLength) return Unauthorized($"Password exceeds maxium length of {PasswordManager.MaxPasswordLength} characters.");
-
             var result = UserDataService.UserNameIsValid(info.UserName);
 
             if (!result.IsValid) return Unauthorized(result.Message);
 
-            if (HttpContext.Request.Cookies.ContainsKey("Session"))
-            {
-                if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName))
-                    return Ok($"Session is live{Environment.NewLine}");
-            }
+            //if (HttpContext.Request.Cookies.ContainsKey("Session"))
+            //{
+            //    if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName))
+            //        return Ok($"Session is live{Environment.NewLine}");
+            //}
 
             var (password, salt) = UserDataService.GetUserPasswordHash(info.UserName);
             var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
@@ -53,7 +51,7 @@ namespace SecureCore.Controllers
             }
             else
             {
-                return Unauthorized();
+                return Unauthorized(result.Message);
             }
         }
 

SecureCore/Services/UserDataService.cs

@@ -37,7 +37,7 @@ namespace SecureCore.Services
 
             using(var connection = new SqlConnection(ConnectionString))
             {
-                using(var command = new SqlCommand("SELECT [Password Hash], [Salt Hash] FROM Login WHERE [User Key] = @UserId", connection))
+                using(var command = new SqlCommand("SELECT [Password Hash], [Salt] FROM Login WHERE [User Key] = @UserId", connection))
                 {
                     command.Parameters.AddWithValue("UserId", userId);
 
@@ -47,7 +47,7 @@ namespace SecureCore.Services
 
                     reader.Read();
 
-                    return (reader["Password Hash"].ToString(), reader["Salt Hash"].ToString());
+                    return (reader["Password Hash"].ToString(), reader["Salt"].ToString());
                 }
             }
         }