glm94/secure-core
1
0
Fork 0
Code Issues 9 Pull Requests Releases Wiki Activity

Added code to support password settings. Fixed a bug where the [FromBody] attribute resulted in null object properties, as well as included more null checks.

Browse Source
This commit is contained in:
glm94
2021-03-09 22:14:29 -06:00
parent 70bb9dd9e2
commit 7008621799
53 changed files with 157 additions and 4377 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SecureCore/Controllers/AuthController.cs
+15 -15
View File
@@ -4,6 +4,7 @@ using System;
using System.Web;
using SecureCore.Services;
using SecureCore.Authentication;
using SecureCore.Models;
namespace SecureCore.Controllers
{
@@ -11,12 +12,13 @@ namespace SecureCore.Controllers
[ApiController]
public class AuthController : Controller
{
public static string BaseUrl { get; set; }
//TODO: Login will only ever return messages like "Wrong username / password." whereas register can return messages like "User exists.", "Password to weak", or "Password in top 100 most used.".
[HttpPost("login")]
[AcceptVerbs("POST")]
public IActionResult Login([FromBody] UserInformation.LoginData info)
public IActionResult Login([FromBody] LoginInfo info)
{
AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
AppSettingsManager.TryGetConnectionString("MainDataConnectionString", out string connectionString);
try
{
@@ -59,9 +61,9 @@ namespace SecureCore.Controllers
[HttpPost("Register")]
[AcceptVerbs("POST")]
public IActionResult Register([FromBody] UserInformation.RegistrationData info)
public IActionResult Register(RegistrationInfo info)
{
AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
AppSettingsManager.TryGetConnectionString("MainDataConnectionString", out string connectionString);
//Verify that the username provided is valid, i.e. no whitespace, special characters, etc.
var result = UserDataService.IsUsernameValid(info.Username);
//If the name isn't valid, return the error message to the user.
@@ -75,15 +77,12 @@ namespace SecureCore.Controllers
if (!result.IsValid) return Unauthorized(result.Message);
if (UserDataService.IsEmailInUse(info.Email, connectionString)) return Unauthorized("This email is already in use.");
var (hash, salt) = PasswordManager.HashPassword(info.Password);
var sessionToken = SessionManager.CreateSessionToken();
var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
try
{
var (hash, salt) = PasswordManager.HashPassword(info.Password);
var sessionToken = SessionManager.CreateSessionToken();
var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
var cookieOptions = GetCookieOptions();
var i = UserDataService.RegisterNewUser(info.Username, info.Email, hash, salt, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString);
@@ -94,6 +93,7 @@ namespace SecureCore.Controllers
}
catch (Exception e)
{
//TODO: redo the message that sent back to the client. There could be more than just a SQL Server error here.
return Unauthorized(e.Message);
}
}
@@ -104,7 +104,7 @@ namespace SecureCore.Controllers
{
if (!HttpContext.Request.Cookies.ContainsKey("Session")) return Ok();
AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
AppSettingsManager.TryGetConnectionString("MainDataConnectionString", out string connectionString);
try
{
@@ -124,7 +124,7 @@ namespace SecureCore.Controllers
[AcceptVerbs("POST")]
public IActionResult ResetPassword([FromQuery] string token, [FromBody] string password)
{
AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
AppSettingsManager.TryGetConnectionString("MainDataConnectionString", out string connectionString);
try
{
@@ -150,7 +150,7 @@ namespace SecureCore.Controllers
[AcceptVerbs("POST")]
public IActionResult CreatePasswordResetLink([FromBody] string email)
{
AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
AppSettingsManager.TryGetConnectionString("MainDataConnectionString", out string connectionString);
//Validate the email input.
var (IsValid, Message) = UserDataService.IsEmailValid(email);
@@ -168,7 +168,7 @@ namespace SecureCore.Controllers
PasswordManager.InsertPasswordResetRequest(email, token, DateTime.Now.AddHours(1), agent, ip, connectionString);
token = HttpUtility.UrlEncode(token);
//TODO: Allow the admin to configure the address that this function creates when doing password resets.
return Ok($"192.168.255.200:5000/auth/ResetPassword?token={token}{Environment.NewLine}");
}
catch(Exception e)