Added and tested the password reset feature. So far so good, needs some more validation but its working and that's a good first step.

SecureCore/Controllers/AuthController.cs

@@ -23,25 +23,26 @@ namespace SecureCore.Controllers
             //TODO: see if the request has an active session key so we don't spam out new keys like mad
             try
             {
+                if (HttpContext.Request.Cookies.ContainsKey("Session"))
+                    if (SessionManager.IsSessionTokenValid(HttpContext.Request.Cookies["Session"], connectionString))
+                        return Ok("Logged in\n");
+
                 //Verify that the username provided is valid, i.e. no whitespace, special characters, etc.
                 var result = UserDataService.IsUsernameValid(info.UserName);
                 //If the name isn't valid, return the error message to the user.
                 if (!result.IsValid) return Unauthorized(result.Message);
 
-                //if (HttpContext.Request.Cookies.ContainsKey("Session"))
-                //{
-                //    if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName))
-                //        return Ok($"Session is live{Environment.NewLine}");
-                //}
                 //Next try to get the user's login data, if the fuction returns empty strings, then the user isn't a registered name.
                 var (password, salt) = PasswordManager.GetPasswordHashAndSalt(info.UserName, connectionString);
                 //If the user name isn't in the system, then simply return a generic error message about something not being right.
                 if (password == string.Empty) return Unauthorized("User name or password is not correct.");
 
-                result = PasswordManager.IsPasswordValid(info.Password, salt, password);
+                result = PasswordManager.IsPasswordValid(info.Password);
 
                 if (!result.IsValid) return Unauthorized(result.Message);
 
+                if(!PasswordManager.IsPasswordAMatch(info.Password, salt, password)) return Unauthorized("User name or password is not correct.");
+
                 var sessionToken = SessionManager.CreateSessionToken();
                 var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
                 var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
@@ -64,6 +65,15 @@ namespace SecureCore.Controllers
         [AcceptVerbs("POST")]
         public IActionResult Register([FromBody] LoginInfo info)
         {
+            //Verify that the username provided is valid, i.e. no whitespace, special characters, etc.
+            var result = UserDataService.IsUsernameValid(info.UserName);
+            //If the name isn't valid, return the error message to the user.
+            if (!result.IsValid) return Unauthorized(result.Message);
+            //Validate the password, make sure its not to long or short, etc.
+            result = PasswordManager.IsPasswordValid(info.Password);
+
+            if (!result.IsValid) return Unauthorized(result.Message);
+
             AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
             var (hash, salt) =  PasswordManager.HashPassword(info.Password);
             var sessionToken = SessionManager.CreateSessionToken();
@@ -99,9 +109,9 @@ namespace SecureCore.Controllers
             return Ok();
         }
 
-        [HttpGet("ResetPassword")]
-        //[AcceptVerbs("GET")]
-        public IActionResult ResetPassword([FromQuery] string token)
+        [HttpPost("ResetPassword")]
+        [AcceptVerbs("POST")]
+        public IActionResult ResetPassword([FromQuery] string token, [FromBody] string password)
         {
             AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
 
@@ -109,17 +119,21 @@ namespace SecureCore.Controllers
             {
                 if (!SessionManager.IsSessionTokenValid(token, connectionString, true)) return Unauthorized("Token invalid");
 
+                var (Hash, Salt) = PasswordManager.HashPassword(password);
+
+                PasswordManager.ResetPassword(Hash, Salt, token, connectionString);
+
+                return Ok("Reset successful\n");
             }
             catch (Exception e)
             {
-
+                return Unauthorized(e.Message);
             }
-            return Ok("Done");
         }
 
         [HttpPost("CreatePasswordResetLink")]
         [AcceptVerbs("POST")]
-        public IActionResult CreatePasswordResetLink([FromBody] string userName) //TODO: this sig should only accept an email, so the link can be sent there.
+        public IActionResult CreatePasswordResetLink([FromBody] string email) //TODO: this sig should only accept an email, so the link can be sent there.
         {
             AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
             var token = SessionManager.CreateSessionToken();
@@ -128,7 +142,7 @@ namespace SecureCore.Controllers
 
             try
             {
-                PasswordManager.InsertPasswordResetRequest(userName, token, DateTime.Now.AddHours(1), agent, ip, connectionString);
+                PasswordManager.InsertPasswordResetRequest(email, token, DateTime.Now.AddHours(1), agent, ip, connectionString);
 
                 token = HttpUtility.UrlEncode(token);