glm94/secure-core
1
0
Fork 0
Code Issues 9 Pull Requests Releases Wiki Activity

Updated the PasswordManager to check for a min password length as that might be a tad important.

Browse Source
This commit is contained in:
glm94
2021-01-12 21:28:11 -06:00
parent 4e25410d30
commit 4721a70ea7
4 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SecureCore/Authentication/PasswordManager.cs
+3 -1
View File
@@ -20,6 +20,7 @@ namespace SecureCore.Authentication
//allowing passwords that are too long can result in a denial-of-service attack. So we must enforce password length limits.
//The recommended length is between 64 and 128, so I decided to go for the upper bounds.
public static int MaxPasswordLength { get; } = 128;
public static int MinPasswordLength { get; } = 16;
public PasswordManager()
{
@@ -36,7 +37,8 @@ namespace SecureCore.Authentication
public static (bool IsValid, string Message) PasswordIsValid(string password, string salt, string passwordHash)
{
if (password.Length > MaxPasswordLength) return (false, $"Password length exceeds {MaxPasswordLength} characters.");
if (password.Length < MinPasswordLength) return (false, $"Your password is too short, it must be at least {MinPasswordLength} characters long and not exceed {MaxPasswordLength} characters.");
if (password.Length > MaxPasswordLength) return (false, $"Your password is too long, it must not exceed {MaxPasswordLength} characters and must contain at least {MinPasswordLength} characters.");
var saltBytes = Convert.FromBase64String(salt);