Updated the password validation and created a username validation function.

SecureCore/Controllers/AuthController.cs

@@ -14,6 +14,7 @@ namespace SecureCore.Controllers
     [ApiController]
     public class AuthController : Controller
     {
+        //TODO: Login will only ever return messages like "Wrong username / password." whereas register can return messages like "User exists.", "Password to weak", or "Password in top 100 most used.".
         [HttpPost("login")]
         [AcceptVerbs("POST")]
         public IActionResult Login([FromBody] LoginInfo info)
@@ -21,6 +22,11 @@ namespace SecureCore.Controllers
             //NOTE: password length should be at most 64 - 128 characters long.
             //Very the user has login data.
             //if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds");
+            if (info.Password.Length > PasswordManager.MaxPasswordLength) return Unauthorized($"Password exceeds maxium length of {PasswordManager.MaxPasswordLength} characters.");
+
+            var result = UserDataService.UserNameIsValid(info.UserName);
+
+            if (!result.IsValid) return Unauthorized(result.Message);
 
             if (HttpContext.Request.Cookies.ContainsKey("Session"))
             {
@@ -31,8 +37,9 @@ namespace SecureCore.Controllers
             var (password, salt) = UserDataService.GetUserPasswordHash(info.UserName);
             var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
             var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
+            result = PasswordManager.PasswordIsValid(info.Password, salt, password);
 
-            if (PasswordManager.PasswordIsValid(info.Password, salt, password))
+            if (result.IsValid)
             {
                 var session = new SessionManager();
 
@@ -89,14 +96,21 @@ namespace SecureCore.Controllers
         //[AcceptVerbs("GET")]
         public IActionResult ResetPassword([FromQuery] string token)
         {
-            if (!UserDataService.IsResetTokenValid(token)) return Unauthorized("Token invalid");
+            try
+            {
+                if (!UserDataService.IsResetTokenValid(token)) return Unauthorized("Token invalid");
 
+            }
+            catch (Exception e)
+            {
+
+            }
             return Ok("Done");
         }
 
         [HttpPost("CreatePasswordResetLink")]
         [AcceptVerbs("POST")]
-        public IActionResult CreatePasswordResetLink([FromBody] string userName)
+        public IActionResult CreatePasswordResetLink([FromBody] string userName) //TODO: this sig should only accept an email, so the link can be sent there.
         {
             var sessionManager = new SessionManager();
             var token = sessionManager.CreateSessionToken();