Added more validation to the various AuthController functions.

2021-01-15 09:41:35 -06:00
parent 8e9824f497
commit 5a9d3621fe
4 changed files with 68 additions and 15 deletions
@@ -17,7 +17,7 @@ namespace SecureCore.Controllers
        public IActionResult Login([FromBody] UserInformation.LoginData info)
        {
            AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
-            //TODO: see if the request has an active session key so we don't spam out new keys like mad
+            
            try
            {
                if (HttpContext.Request.Cookies.ContainsKey("Session"))
@@ -27,6 +27,10 @@ namespace SecureCore.Controllers
                //Verify that the username provided is valid, i.e. no whitespace, special characters, etc.
                var result = UserDataService.IsUsernameValid(info.Username);
                //If the name isn't valid, return the error message to the user.
+                if (!result.IsValid) return Unauthorized(result.Message);
+                //Now make sure the password is valid.
+                result = PasswordManager.IsPasswordValid(info.Password);
+
                if (!result.IsValid) return Unauthorized(result.Message);

                //Next try to get the user's login data, if the fuction returns empty strings, then the user isn't a registered name.
@@ -34,10 +38,6 @@ namespace SecureCore.Controllers
                //If the user name isn't in the system, then simply return a generic error message about something not being right.
                if (password == string.Empty) return Unauthorized("User name or password is not correct.");

-                result = PasswordManager.IsPasswordValid(info.Password);
-
-                if (!result.IsValid) return Unauthorized(result.Message);
-
                if(!PasswordManager.IsPasswordAMatch(info.Password, salt, password)) return Unauthorized("User name or password is not correct.");

                var sessionToken = SessionManager.CreateSessionToken();
@@ -62,6 +62,7 @@ namespace SecureCore.Controllers
        [AcceptVerbs("POST")]
        public IActionResult Register([FromBody] UserInformation.RegistrationData info)
        {
+            AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
            //Verify that the username provided is valid, i.e. no whitespace, special characters, etc.
            var result = UserDataService.IsUsernameValid(info.Username);
            //If the name isn't valid, return the error message to the user.
@@ -71,7 +72,12 @@ namespace SecureCore.Controllers

            if (!result.IsValid) return Unauthorized(result.Message);

-            AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
+            result = UserDataService.IsEmailValid(info.Email);
+
+            if (!result.IsValid) return Unauthorized(result.Message);
+
+            if (UserDataService.IsEmailInUse(info.Email, connectionString)) return Unauthorized("This email is already in use.");
+
            var (hash, salt) =  PasswordManager.HashPassword(info.Password);
            var sessionToken = SessionManager.CreateSessionToken();
            var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
@@ -97,9 +103,18 @@ namespace SecureCore.Controllers
        [AcceptVerbs("POST")]
        public IActionResult Logout()
        {
+            if (!HttpContext.Request.Cookies.ContainsKey("Session")) return Ok();
+
            AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);

-            SessionManager.Logout(HttpContext.Request.Cookies["Session"], connectionString);
+            try
+            {
+                SessionManager.Logout(HttpContext.Request.Cookies["Session"], connectionString);
+            }
+            catch(Exception e)
+            {
+                //TODO: decide what to do here. If the SQL fails to clear the token from the database, do we want to clear the token cookie?
+            }

            HttpContext.Response.Cookies.Delete("Session");

@@ -111,10 +126,14 @@ namespace SecureCore.Controllers
        public IActionResult ResetPassword([FromQuery] string token, [FromBody] string password)
        {
            AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
-
+            
            try
            {
-                if (!SessionManager.IsSessionTokenValid(token, connectionString, true)) return Unauthorized("Token invalid");
+                if (!SessionManager.IsSessionTokenValid(token, connectionString, true)) return Unauthorized("This link has expired, please request a new email reset link.");
+
+                var (IsValid, Message) = PasswordManager.IsPasswordValid(password);
+
+                if (!IsValid) return Unauthorized(Message);

                var (Hash, Salt) = PasswordManager.HashPassword(password);

@@ -133,6 +152,14 @@ namespace SecureCore.Controllers
        public IActionResult CreatePasswordResetLink([FromBody] string email)
        {
            AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
+            //Validate the email input.
+            var (IsValid, Message) = UserDataService.IsEmailValid(email);
+
+            if (!IsValid) return Unauthorized(Message);
+
+            //If its a properly formatted email, then check to see if its in use by anyone.
+            if (!UserDataService.IsEmailInUse(email, connectionString)) return Unauthorized("Email is not valid.");
+
            var token = SessionManager.CreateSessionToken();
            var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
            var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString());