From 8e9824f4972af122c0fe2e4fbb3ced1bc9b287a4 Mon Sep 17 00:00:00 2001 From: Garrritt McCune Date: Thu, 14 Jan 2021 15:48:52 -0600 Subject: [PATCH] Attempted to clean up the AuthController just a tad. --- .vs/SecureCore/v16/.suo | Bin 58880 -> 58880 bytes SecureCore/Controllers/AuthController.cs | 26 +++++++---------------- SecureCore/Models/UserInformation.cs | 18 ++++++++++++++++ 3 files changed, 26 insertions(+), 18 deletions(-) create mode 100644 SecureCore/Models/UserInformation.cs diff --git a/.vs/SecureCore/v16/.suo b/.vs/SecureCore/v16/.suo index 2ea93876ec243ef5b43ce6e74a999af90783e8fd..4b7545f8f262ca298ae7f3979c4d77df3bdadb64 100644 GIT binary patch delta 4999 zcmZoT!`yI&d4dh2)J9u=CPvxGicIo+6EzLfzln*$p-K!43?RNf z0|P@ClnvtRGB7Y`LHPnu8YB+FIt&a9254g8P<{vl1B2VdK=Dv(1_lOR1_lO81_lN( z1_lO@OJf)q7)%)$7^E2(7|fv>Kn8-a2Ll6x2vp1#N^3xAO(@MeF;HB@9m)Y|;$UE4 zFah~jL0v~zk%56Bl!1Xkn}LBro`HcOf`Ne{ih+UQ@Bjb*qZt?&gc%qZQW+Q+;ushh z{!L7j7EFhll)=EjkjcQnkT)?ZlDENaFcsISc1`2&;Sm=9l zf~^913}+OGB1Zwp#URWHii&zskTd@O|1ZwKz#z!Lz#zoHz#zfEzyOL71*ij@7#J92 z85kJY7#J8pF#^&p$-uw>iV+?L1_l`h1_myuT9BL^0|Nse0|Ns)0|SE#0|Nsn;2c0P z!oa|w0u3uQ1_lOo1_oCKL#RejEP*tGVhKbiLd8LB5H@09U@&H2U@&7~U{Hn1SwQK@ z4>)9GK>_cG6!0KTt_%ze@eB+M91{b*C#P_VOe|ngNq|N|3IhW}GSv5JP=m6d^yCGc zBD@7q4#=RSiGlW$xH=rw7#SE;7#SE;85tP<{r~@8osoe-gOPzjlaYZzi;;mrn~{M* zhmnCnmyv-%kCA~vpOJyVfRTa0kdcAGh>?N8c=JXsbH+)09xUJl1I;s&OZWmf7@^4$ z7K@X=@HH?hPcG%J=eYn)xu7gW2UmcC71I^0U{`GZDb3C_NuY%B{p3=Cdd7E?zY5ed zo}XMQcy6*YvmvAGS&FltWzs3ksmhnmIY4?Y40ppXS&P!R)4K%i)JV_;waWjas}^<-dR z@M2(K@P&*eOL<*FH;SnO|&k0V~pu7OnF!_sI3nRzmN_lS%P&NQ%9hekrB?AM4 z#pIv-)ffTOJ^9E6waI-uB{thxDKRQkscTuBIQoCzlcQ(qH@M6J@9X(Su zk!Rupqt4w769a`O%Q!!oB;*VVH*lQ#fmuk=Imy6f@)2PJ#@&-k4g5G6LD?Tvbil%6 z@)v^!My<)EhV`tV;xlIRPhEDVNk%1XJ`4;D2Y4q}8F_)UPyP}X!UC!qVEP!HCYKu5 zvx1_DY4T6e-;BDGzv}pNa6*e^xH6r|rQ-e^pmG3IaKVIGL4_{Mozebp1t%C;K;i}YOv z28NBG(uIM6Atf~}u{5V7z9hH6(bUp-Gk=;PqbDfZKm`;l0|P_f+2{I4{dE^**6KR7 z1Rg9{ck-*{m#?}`!tWnRyKr->e{0lr5`ACWoU<}I!LLKt$@W^0?73ARu5Ibmbz+#@ znQlJ0Azfthl{AaVDPgV&g4fouT8#Ilr>pE)?~5)6VGIaVjh^$lN*XTCOhg` zOm-+^nS7)_WU@q=-Q;U!TEY+B{r?ZDzd)V_*$2u_mnY~>K2RpY^$#k*z&2TtNrX3_ zp@<=sL65XaFi zES5=S9$bCk)HAK0c9HucZ)PhmS{i0Bv8U(noRklf4_G*`FOXZNu!sj-PDoj*ap_pp zxFzNkr&hO3_OjfDQZh_-4l_hA3nu>z_2vK-7RY%5sbJs$RUe=>6)brYS4z|~VlNbU zz=Z-Ro*5Vz7R_K{?3v71l{z_~iiNX?p^PDuA(kU6ftBn7LnbI4Fz7KPGZat0TNgh0P=gL5!(_$=`^^pY4UCJj zm?oK&5LNz6YWyZ*;^u6oYhhvLsC$4H(l}&gm@GK|Fyr3IA6ktjxj2LBw8;%FCCCK^ z4=8j%EiaI-CN+DD<>sfP<`l=27N-_v=B4EqB#}>g4jXrKV=4n$%c!97$;3`RIo=b^!zv(L9KF70SQYKte~O@S`>mR*b9m* zlk4{IP5y90W^zbR&g8`TdXsb8f;KxWZD3ryzm1WRb@IW<4wENNk(z9`n1AvPe@Dia z$&IT`Cg&gEnXEb0ov|Fu)0<*DIoqF8s1?-A1bHK%C_gPTCsj3O^8R+m$rDy2*{JE7**| z`DM}?r^(5a1;LK7SuHeqepkrk(+e$obq$$@M2C+kg~Gn&;!i2f7)Dem*=vR?gVW zxaB`1*@%Hb;(#B7!2rrd%uqJt1{quY>3qclGydbdq0~=_VXAZ;U#!VTZ z`aw7pTB~~^YW2wzcL;B8I1PB0BCPv1|icIo+2XuZs|MT)1qa_0a!vXKfRZM;?vJ4CiljS27 zCmS%aGwMzL%2dy0#=yYvnR#**a~1D-1_p)}J_axln9Rr`JTXPU)SQ8V;s5{t|23fW zKM?2t|NmkP3=CROF_4f7l�Wz#ua*P&hP?fq@~Efq_93DiOxOz#t7}gEZ(fFfiyc zFfgbyFfar&Ffgz%FfeFC7bFUP>ZAOe+Vh0-z%3=EPC3=BLB3=A9$3=C`x3=CNe z3=HuM3`XFX1;uy*G;*XE7#K968bJnvuqP6qb7G*p3@-x%gE0dGg9!rz11R}`6j?AZ zFc^YT*8>h2O$P=B21f=41}6pv1{bJqR|Wc?~j1_lL?=?geT7?UOjdQal&FjQt_U{GOXU{GabU{GUZU{Ggd zV9;P>V9;b_V9;WO1da|P1A{J<{cmHUJL4p-20?JBF)}cK3;?nJZA{E(oW$e70!m`A z>@m57Cx8Q#CP6-f3x45gU{su3%3II650qpl{}irfJUF>jq@HpA7QI88^Qt#O_%`das~#5J(GVL{$|vf{ME=0q6HMaFcpm2lS_^LIY6NXNZr#Q7~a<7ZYWP@$8lS3mk z84Wi#L^Lo?5-DLk2M+(U;P5{(xm2`!lgeR6PDXDA1_n?O0X2`C6_gPeCNGo_pDZB3 zf`K(8JUBqb4k$rPu8>e+)Bq`E0TpMHcSu+mfW$%A9+bC{(zi1-jf2uRsL%lwHXwDA z6c*{85kJ$f?P70L*0M}R6<{1U|@I$ z$_p;)B^>V=7#Kc)I0w`nCK-KUG@bl4sh-gUYt*xX@+`~dpStW!lXP4-K-pXsq!pGJ zcTFzU@tb^D)OWIgZVIF3Yx0@ zz@HObpn!5SG}PG{?IxER*0X}jW~RwMjjJbrF_D=(!Ni0El*B=45w1{m@>i33M!CtQ zrrne5oI!bkk!^CRT{EM@=AU-#jFV!PNh$7aypVMM`^h5f)T9f)L=!w#Hvi>4Cm~{S za`J%~2ll{Dy#;F)GfWH=o-7rs#$~2sYFy(6N;#9gVz+HlN?=rYZh2+zw4b59n*7s} zG^JTQ_9QXiQu?g8>&It_jhnj9+??E?+^|UslzKqULr&V@;-6viPiwEqhed5CH`st( zILVh~^A8&i#zhWHlQdo^=AKKLzsS?aUqgB6r3DA(aPH&Fs*1*cgR>Lje4c=v zCZqXel9dYws1^g&1Tg$V8d-`PDNAks zugu6ad5MGwMos|b4)olh3W{w|iUCC#sFnuR$ROu~@&~B21LZVBa5}vqp&<(@yFkSi za^?V~Xb|?8EX%44N$4(;dnUP*@Fp|xFcf<^Tg8MHr*chhboo5_nXA;~d*d52MZ{sVD=D7Xp8!oHuW851Z6R3E3NC6?xt#Fyk2Sh$*)ZszweWV8X*^o-D2q3`T-{iFW6i!y6bQXY$1T`IGbfE=_Lm=b3EfZ!-CS zKiCD6d|4*51laJWAiQgAZsdaLU1TpJdz~onCZ&o@4he7q`wG$qWt<$~AwJ2MMI02I z58nO%4{;`(oNTyPcT%9pVhTy~(!9^7TOssSL#osSG6y0St)@#SFy^zB@9IjnGAUh=?n@CB@Fot*$k-+c?>!X3P^gK z81flXu<9s4*dz$H3gmxKLlP7wlNt_8KG>o`nGDGci3}h* zp8?e873OpXhgT}YjLD8E$}FI4Gkmxc+mnQuY#<@_x>s~^z&3-)2HSim^*AsWrN&Hl*q$H>>cB(N zhSGs@1_lNJXrGsP@{ULsUPgvwhGNhN0s{lXq{)oujVB-I`VY#X43ksO*-mcQc7Q$N zJgAsrnEdg!A!{N-0Yky$y}Pw1U+|Zhyy%p}X2vc585#dip66$=`PNM}mPwBeOqM(O zXtIw6-{yinpBN`M_SQ4TP$zUW940evs|WXVVz;Y+LZxxLydr2I0_H!^5CmvE0MtHY zh6sX^!}|2XhXHrTgmveLN*P%tiDbdGVd!;U$M?iNpkr=A>!Q@A$9Edi1v%t;* zrpb#g-kZEqQ)Kg$>wGMm8!m}4PTp}lYtt@}ug~6NnsliFB73=yadE>X#>odFSthGp GtpNb#y#c%c diff --git a/SecureCore/Controllers/AuthController.cs b/SecureCore/Controllers/AuthController.cs index c9676d8..c8196de 100644 --- a/SecureCore/Controllers/AuthController.cs +++ b/SecureCore/Controllers/AuthController.cs @@ -2,9 +2,6 @@ using Microsoft.AspNetCore.Http; using System; using System.Web; -using System.Collections.Generic; -using System.Data.SqlClient; -using System.Threading.Tasks; using SecureCore.Services; using SecureCore.Authentication; @@ -17,7 +14,7 @@ namespace SecureCore.Controllers //TODO: Login will only ever return messages like "Wrong username / password." whereas register can return messages like "User exists.", "Password to weak", or "Password in top 100 most used.". [HttpPost("login")] [AcceptVerbs("POST")] - public IActionResult Login([FromBody] LoginInfo info) + public IActionResult Login([FromBody] UserInformation.LoginData info) { AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString); //TODO: see if the request has an active session key so we don't spam out new keys like mad @@ -28,12 +25,12 @@ namespace SecureCore.Controllers return Ok("Logged in\n"); //Verify that the username provided is valid, i.e. no whitespace, special characters, etc. - var result = UserDataService.IsUsernameValid(info.UserName); + var result = UserDataService.IsUsernameValid(info.Username); //If the name isn't valid, return the error message to the user. if (!result.IsValid) return Unauthorized(result.Message); //Next try to get the user's login data, if the fuction returns empty strings, then the user isn't a registered name. - var (password, salt) = PasswordManager.GetPasswordHashAndSalt(info.UserName, connectionString); + var (password, salt) = PasswordManager.GetPasswordHashAndSalt(info.Username, connectionString); //If the user name isn't in the system, then simply return a generic error message about something not being right. if (password == string.Empty) return Unauthorized("User name or password is not correct."); @@ -48,7 +45,7 @@ namespace SecureCore.Controllers var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt); var cookieOptions = GetCookieOptions(); - SessionManager.Login(info.UserName, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString); + SessionManager.Login(info.Username, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString); HttpContext.Response.Cookies.Append("Session", sessionToken, cookieOptions); @@ -63,10 +60,10 @@ namespace SecureCore.Controllers [HttpPost("Register")] [AcceptVerbs("POST")] - public IActionResult Register([FromBody] LoginInfo info) + public IActionResult Register([FromBody] UserInformation.RegistrationData info) { //Verify that the username provided is valid, i.e. no whitespace, special characters, etc. - var result = UserDataService.IsUsernameValid(info.UserName); + var result = UserDataService.IsUsernameValid(info.Username); //If the name isn't valid, return the error message to the user. if (!result.IsValid) return Unauthorized(result.Message); //Validate the password, make sure its not to long or short, etc. @@ -84,7 +81,7 @@ namespace SecureCore.Controllers { var cookieOptions = GetCookieOptions(); - var i = UserDataService.RegisterNewUser(info.UserName, info.Email, hash, salt, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString); + var i = UserDataService.RegisterNewUser(info.Username, info.Email, hash, salt, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString); HttpContext.Response.Cookies.Append("Session", sessionToken, cookieOptions); @@ -133,7 +130,7 @@ namespace SecureCore.Controllers [HttpPost("CreatePasswordResetLink")] [AcceptVerbs("POST")] - public IActionResult CreatePasswordResetLink([FromBody] string email) //TODO: this sig should only accept an email, so the link can be sent there. + public IActionResult CreatePasswordResetLink([FromBody] string email) { AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString); var token = SessionManager.CreateSessionToken(); @@ -168,13 +165,6 @@ namespace SecureCore.Controllers } } - public class LoginInfo - { - public string UserName { get; set; } - public string Password { get; set; } - public string Email { get; set; } - } - //TODO: Read more https://www.valentinog.com/blog/cookies/ // And this https://blog.webf.zone/ultimate-guide-to-http-cookies-2aa3e083dbae } diff --git a/SecureCore/Models/UserInformation.cs b/SecureCore/Models/UserInformation.cs new file mode 100644 index 0000000..48f7a7f --- /dev/null +++ b/SecureCore/Models/UserInformation.cs @@ -0,0 +1,18 @@ +namespace SecureCore.Services +{ + public class UserInformation + { + public struct LoginData + { + public string Username; + public string Password; + } + + public struct RegistrationData + { + public string Username; + public string Password; + public string Email; + } + } +}