Tweaked the SessionManager's IsSessionTokenValid function to accept a connection string to standardize the interfaces on all the SessionManager functions.

SecureCore/AppSettingsManager.cs

@@ -63,7 +63,7 @@ namespace SecureCore
 
         public static void InitializeSettings()
         {
-            if (Settings != null) throw new InvalidOperationException("The in memory JSON settings has already been loaded. Operation aborted.");
+            if (Settings != null) throw new InvalidOperationException("The in memory JSON settings have already been loaded. Operation aborted.");
             if (!File.Exists(AppSettingsPath)) throw new FileNotFoundException($"The app settings file '{AppSettingsPath}' couldn't be found.");
 
             try

SecureCore/Authentication/PasswordManager.cs

@@ -24,6 +24,8 @@ namespace SecureCore.Authentication
 
         public static void InitializeSettings()
         {
+            if (!string.IsNullOrEmpty(Pepper)) throw new InvalidOperationException("The PasswordManager's settings have already been initialized. Operation aborted.");
+
             if (AppSettingsManager.TryGetSettingInt(SectionName, "MaxLength", out int maxPasswordLength))
             {
                 //As noted in this article https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#maximum-password-lengths

SecureCore/Authentication/SessionManager.cs

@@ -34,10 +34,8 @@ namespace SecureCore.Authentication
             return Convert.ToBoolean(result);
         }
 
-        public static bool IsSessionTokenValid(HttpContext context)
+        public static bool IsSessionTokenValid(HttpContext context, string connectionString)
         {
-            AppSettingsManager.TryGetConnectionString("MainDataConnectionString", out string connectionString);
-
             if (!context.Request.Cookies.ContainsKey(SessionCookieName)) return false;
 
             return IsSessionTokenValid(context.Request.Cookies[SessionCookieName], connectionString);

SecureCore/Controllers/AuthController.cs

@@ -22,7 +22,7 @@ namespace SecureCore.Controllers
             
             try
             {
-                if (SessionManager.IsSessionTokenValid(HttpContext))
+                if (SessionManager.IsSessionTokenValid(HttpContext, connectionString))
                     return Ok("Logged in\n");
 
                 //Verify that the username provided is valid, i.e. no whitespace, special characters, etc.
@@ -168,7 +168,7 @@ namespace SecureCore.Controllers
                 PasswordManager.InsertPasswordResetRequest(email, token, DateTime.Now.AddHours(1), agent, ip, connectionString);
 
                 token = HttpUtility.UrlEncode(token);
-                //TODO: Allow the admin to configure the address that this function creates when doing password resets.
+                //TODO: Email the link to the supplied email.
                 return Ok($"192.168.255.200:5000/auth/ResetPassword?token={token}{Environment.NewLine}");
             }
             catch(Exception e)

SecureCore/Controllers/EmployeeController.cs

@@ -24,7 +24,9 @@ namespace SecureCore.Controllers
         [HttpGet]
         public IActionResult Get()
         {
-            if(SessionManager.IsSessionTokenValid(HttpContext))
+            AppSettingsManager.TryGetConnectionString("MainDataConnectionString", out string connectionString);
+
+            if (SessionManager.IsSessionTokenValid(HttpContext, connectionString))
                 return Ok(DataService.Get());
             else
                return Unauthorized();
@@ -33,7 +35,9 @@ namespace SecureCore.Controllers
         [HttpGet("{id}", Name = "Get")]
         public IActionResult Get(int id)
         {
-            if (SessionManager.IsSessionTokenValid(HttpContext))
+            AppSettingsManager.TryGetConnectionString("MainDataConnectionString", out string connectionString);
+
+            if (SessionManager.IsSessionTokenValid(HttpContext, connectionString))
                 return Ok(DataService.GetById(id));
             else
                 return Unauthorized();

SecureCore/appsettings.json

@@ -14,7 +14,7 @@
     "doamin": "copyrightcrusader.org"
   },
   "PasswordSettings": {
-    "Peppser": "rVk/OwQUw01qy76Q+5WimPk+NdqUMMghftMXyJzzckOj/+eFn056PDYzBD61E/ZNjRdgiMK6RhcHEcdfpJdbcw==",
+    "Pepper": "rVk/OwQUw01qy76Q+5WimPk+NdqUMMghftMXyJzzckOj/+eFn056PDYzBD61E/ZNjRdgiMK6RhcHEcdfpJdbcw==",
     "MaxLength": 128,
     "MinLength": 22
   }