diff --git a/.vs/SecureCore/v16/.suo b/.vs/SecureCore/v16/.suo index 2ea9387..4b7545f 100644 Binary files a/.vs/SecureCore/v16/.suo and b/.vs/SecureCore/v16/.suo differ diff --git a/SecureCore/Controllers/AuthController.cs b/SecureCore/Controllers/AuthController.cs index c9676d8..c8196de 100644 --- a/SecureCore/Controllers/AuthController.cs +++ b/SecureCore/Controllers/AuthController.cs @@ -2,9 +2,6 @@ using Microsoft.AspNetCore.Http; using System; using System.Web; -using System.Collections.Generic; -using System.Data.SqlClient; -using System.Threading.Tasks; using SecureCore.Services; using SecureCore.Authentication; @@ -17,7 +14,7 @@ namespace SecureCore.Controllers //TODO: Login will only ever return messages like "Wrong username / password." whereas register can return messages like "User exists.", "Password to weak", or "Password in top 100 most used.". [HttpPost("login")] [AcceptVerbs("POST")] - public IActionResult Login([FromBody] LoginInfo info) + public IActionResult Login([FromBody] UserInformation.LoginData info) { AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString); //TODO: see if the request has an active session key so we don't spam out new keys like mad @@ -28,12 +25,12 @@ namespace SecureCore.Controllers return Ok("Logged in\n"); //Verify that the username provided is valid, i.e. no whitespace, special characters, etc. - var result = UserDataService.IsUsernameValid(info.UserName); + var result = UserDataService.IsUsernameValid(info.Username); //If the name isn't valid, return the error message to the user. if (!result.IsValid) return Unauthorized(result.Message); //Next try to get the user's login data, if the fuction returns empty strings, then the user isn't a registered name. - var (password, salt) = PasswordManager.GetPasswordHashAndSalt(info.UserName, connectionString); + var (password, salt) = PasswordManager.GetPasswordHashAndSalt(info.Username, connectionString); //If the user name isn't in the system, then simply return a generic error message about something not being right. if (password == string.Empty) return Unauthorized("User name or password is not correct."); @@ -48,7 +45,7 @@ namespace SecureCore.Controllers var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt); var cookieOptions = GetCookieOptions(); - SessionManager.Login(info.UserName, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString); + SessionManager.Login(info.Username, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString); HttpContext.Response.Cookies.Append("Session", sessionToken, cookieOptions); @@ -63,10 +60,10 @@ namespace SecureCore.Controllers [HttpPost("Register")] [AcceptVerbs("POST")] - public IActionResult Register([FromBody] LoginInfo info) + public IActionResult Register([FromBody] UserInformation.RegistrationData info) { //Verify that the username provided is valid, i.e. no whitespace, special characters, etc. - var result = UserDataService.IsUsernameValid(info.UserName); + var result = UserDataService.IsUsernameValid(info.Username); //If the name isn't valid, return the error message to the user. if (!result.IsValid) return Unauthorized(result.Message); //Validate the password, make sure its not to long or short, etc. @@ -84,7 +81,7 @@ namespace SecureCore.Controllers { var cookieOptions = GetCookieOptions(); - var i = UserDataService.RegisterNewUser(info.UserName, info.Email, hash, salt, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString); + var i = UserDataService.RegisterNewUser(info.Username, info.Email, hash, salt, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString); HttpContext.Response.Cookies.Append("Session", sessionToken, cookieOptions); @@ -133,7 +130,7 @@ namespace SecureCore.Controllers [HttpPost("CreatePasswordResetLink")] [AcceptVerbs("POST")] - public IActionResult CreatePasswordResetLink([FromBody] string email) //TODO: this sig should only accept an email, so the link can be sent there. + public IActionResult CreatePasswordResetLink([FromBody] string email) { AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString); var token = SessionManager.CreateSessionToken(); @@ -168,13 +165,6 @@ namespace SecureCore.Controllers } } - public class LoginInfo - { - public string UserName { get; set; } - public string Password { get; set; } - public string Email { get; set; } - } - //TODO: Read more https://www.valentinog.com/blog/cookies/ // And this https://blog.webf.zone/ultimate-guide-to-http-cookies-2aa3e083dbae } diff --git a/SecureCore/Models/UserInformation.cs b/SecureCore/Models/UserInformation.cs new file mode 100644 index 0000000..48f7a7f --- /dev/null +++ b/SecureCore/Models/UserInformation.cs @@ -0,0 +1,18 @@ +namespace SecureCore.Services +{ + public class UserInformation + { + public struct LoginData + { + public string Username; + public string Password; + } + + public struct RegistrationData + { + public string Username; + public string Password; + public string Email; + } + } +}