Updated the password validation and created a username validation function.

SecureCore/Authentication/PasswordManager.cs

@@ -16,6 +16,10 @@ namespace SecureCore.Authentication
         private static KeyDerivationPrf KeyType { get; } = KeyDerivationPrf.HMACSHA512;
         private static int KeySize { get; } = 512 / 8;
         private static int SaltSize { get; } = 128 / 8; //128 bit salt
+        //As noted here: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#maximum-password-lengths
+        //allowing passwords that are too long can result in a denial-of-service attack. So we must enforce password length limits.
+        //The recommended length is between 64 and 128, so I decided to go for the upper bounds.
+        public static int MaxPasswordLength { get; } = 128;
 
         public PasswordManager()
         {
@@ -30,11 +34,16 @@ namespace SecureCore.Authentication
             return (GetHash(password, salt), Convert.ToBase64String(salt));
         }
 
-        public static bool PasswordIsValid(string password, string salt, string passwordHash)
+        public static (bool IsValid, string Message) PasswordIsValid(string password, string salt, string passwordHash)
         {
+            if (password.Length > MaxPasswordLength) return (false, $"Password length exceeds {MaxPasswordLength} characters.");
+
             var saltBytes = Convert.FromBase64String(salt);
 
-            return passwordHash == GetHash(password, saltBytes);
+            if (passwordHash == GetHash(password, saltBytes))
+                return (true, string.Empty);
+            else
+                return (false, string.Empty);
         }
 
         public static (string PasswordHash, string SaltHash) GetUserPasswordHash(int userId)