Added the first part of allowing the user to reset their password.

SecureCore/Authentication/PasswordManager.cs

@@ -58,23 +58,17 @@ namespace SecureCore.Authentication
             }
         }
 
-        public static string HashStringData(string data, byte[] salt = null)
-        {
-            return data;
-
-            if (salt == null) salt = new byte[0];
-
-            return GetHash(data, salt);
-        }
-
         public static string HashStringData(string data, string salt = "")
         {
-            return data;
-
             var saltBytes = new byte[0];
 
             if(!string.IsNullOrEmpty(salt))
                 saltBytes = Convert.FromBase64String(salt);
+            else
+            {
+                saltBytes = new byte[SaltSize];
+                ByteGenerator.GetRandomBytes(ref saltBytes);
+            }
 
             return GetHash(data, saltBytes);
         }

SecureCore/Controllers/AuthController.cs

@@ -16,11 +16,17 @@ namespace SecureCore.Controllers
     {
         [HttpPost("login")]
         [AcceptVerbs("POST")]
-        public IActionResult Login(LoginInfo info)
+        public IActionResult Login([FromBody] LoginInfo info)
         {
-            //NOTE: password length should be a most 64 - 128 characters long.
+            //NOTE: password length should be at most 64 - 128 characters long.
             //Very the user has login data.
-            if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds");
+            //if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds");
+
+            if (HttpContext.Request.Cookies.ContainsKey("Session"))
+            {
+                if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName))
+                    return Ok($"Session is live{Environment.NewLine}");
+            }
 
             var (password, salt) = UserDataService.GetUserPasswordHash(info.UserName);
             var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
@@ -28,17 +34,11 @@ namespace SecureCore.Controllers
 
             if (PasswordManager.PasswordIsValid(info.Password, salt, password))
             {
-                if (HttpContext.Request.Cookies.ContainsKey("Session"))
-                {
-                    if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName))
-                        return Ok($"Session is live{Environment.NewLine}");
-                }
-
                 var session = new SessionManager();
 
                 var sessionToken = session.CreateSessionToken();
 
-                UserDataService.SetUserSessionToken(UserDataService.GetUserId(info.UserName), sessionToken, DateTime.Now.AddDays(7), agent, ip);
+                UserDataService.SetUserSessionToken(info.UserName, sessionToken, DateTime.Now.AddDays(7), agent, ip);
 
                 HttpContext.Response.Cookies.Append("Session", sessionToken, GetCookieOptions());
 
@@ -52,7 +52,7 @@ namespace SecureCore.Controllers
 
         [HttpPost("Register")]
         [AcceptVerbs("POST")]
-        public IActionResult Register(LoginInfo info)
+        public IActionResult Register([FromBody] LoginInfo info)
         {
             var (hash, salt) =  PasswordManager.HashPassword(info.Password);
             var session = new SessionManager();
@@ -76,15 +76,43 @@ namespace SecureCore.Controllers
 
         [HttpPost("Logout")]
         [AcceptVerbs("POST")]
-        public IActionResult Logout(LoginInfo info)
+        public IActionResult Logout()
         {
-            UserDataService.DestorySession(HttpContext.Request.Cookies["Session"]);
+            UserDataService.DestroySession(HttpContext.Request.Cookies["Session"]);
 
             HttpContext.Response.Cookies.Delete("Session");
 
             return Ok();
         }
 
+        [HttpGet("ResetPassword")]
+        //[AcceptVerbs("GET")]
+        public IActionResult ResetPassword([FromQuery] string token)
+        {
+            return Ok("Done");
+        }
+
+        [HttpPost("CreatePasswordResetLink")]
+        [AcceptVerbs("POST")]
+        public IActionResult CreatePasswordResetLink([FromBody] string userName)
+        {
+            var sessionManager = new SessionManager();
+            var token = sessionManager.CreateSessionToken();
+            var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
+            var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString());
+
+            try
+            {
+                UserDataService.SetUserSessionToken(userName, token, DateTime.Now.AddHours(1), agent, ip, true);
+
+                return Ok($"192.168.255.200:5000/auth/ResetPassword?{token}{Environment.NewLine}");
+            }
+            catch(Exception e)
+            {
+                return Unauthorized($"{e.Message}{Environment.NewLine}");
+            }
+        }
+
         private CookieOptions GetCookieOptions()
         {
             return new CookieOptions

SecureCore/Services/UserDataService.cs

@@ -84,17 +84,18 @@ namespace SecureCore.Services
             }
         }
 
-        public static void SetUserSessionToken(int userId, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress)
+        public static void SetUserSessionToken(string userName, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress, bool isResetToken = false)
         {
             using (var connection = new SqlConnection(ConnectionString))
             {
-                using (var command = new SqlCommand("INSERT INTO [Session]([Session Token], [Expiration Date], [User ID], [User Agent], [IP Address]) VALUES (@SessionToken, @ExpirationDate, @UserKey, @UserAgent, @IpAddress)", connection))
+                using (var command = new SqlCommand("InsertSessionToken", connection) { CommandType = CommandType.StoredProcedure })
                 {
                     command.Parameters.AddWithValue("SessionToken", sessionToken);
                     command.Parameters.AddWithValue("ExpirationDate", expirationDate);
-                    command.Parameters.AddWithValue("UserKey", userId);
+                    command.Parameters.AddWithValue("UserName", userName);
                     command.Parameters.AddWithValue("UserAgent", userAgent);
                     command.Parameters.AddWithValue("IpAddress", ipAddress);
+                    command.Parameters.AddWithValue("PendingReset", isResetToken);
 
                     connection.Open();
 
@@ -131,10 +132,9 @@ namespace SecureCore.Services
         {
             using (var connection = new SqlConnection(ConnectionString))
             {
-                using (var command = new SqlCommand("SELECT 1 AS Valid WHERE EXISTS(SELECT 1 FROM Session WHERE [Session Token] = @SessionToken)", connection))// AND[User ID] = @UserId)", connection))
+                using (var command = new SqlCommand("ValidateSessionToken", connection) { CommandType = CommandType.StoredProcedure })
                 {
                     command.Parameters.AddWithValue("SessionToken", sessionToken);
-                    //command.Parameters.AddWithValue("UserId", GetUserId(userName));
 
                     connection.Open();
 
@@ -145,11 +145,11 @@ namespace SecureCore.Services
             }
         }
 
-        public static void DestorySession(string sessionToken)
+        public static void DestroySession(string sessionToken)
         {
             using (var connection = new SqlConnection(ConnectionString))
             {
-                using (var command = new SqlCommand("DELETE FROM [Session] WHERE [Session Token] = @SessionToken", connection))
+                using (var command = new SqlCommand("DestroySession", connection) { CommandType = CommandType.StoredProcedure })
                 {
                     command.Parameters.AddWithValue("SessionToken", sessionToken);
 
@@ -159,5 +159,20 @@ namespace SecureCore.Services
                 }
             }
         }
+
+        //public static void ResetPassword(string email)
+        //{
+        //    using (var connection = new SqlConnection(ConnectionString))
+        //    {
+        //        using (var command = new SqlCommand("DestroySession", connection) { CommandType = CommandType.StoredProcedure })
+        //        {
+        //            command.Parameters.AddWithValue("SessionToken", sessionToken);
+
+        //            connection.Open();
+
+        //            command.ExecuteNonQuery();
+        //        }
+        //    }
+        //}
     }
 }