diff --git a/.vs/SecureCore/DesignTimeBuild/.dtbcache.v2 b/.vs/SecureCore/DesignTimeBuild/.dtbcache.v2 index ebcea2b..7b5e4b6 100644 Binary files a/.vs/SecureCore/DesignTimeBuild/.dtbcache.v2 and b/.vs/SecureCore/DesignTimeBuild/.dtbcache.v2 differ diff --git a/.vs/SecureCore/v16/.suo b/.vs/SecureCore/v16/.suo index 5da4668..5a982d6 100644 Binary files a/.vs/SecureCore/v16/.suo and b/.vs/SecureCore/v16/.suo differ diff --git a/SecureCore/Authentication/PasswordManager.cs b/SecureCore/Authentication/PasswordManager.cs index be4877b..e54d7f1 100644 --- a/SecureCore/Authentication/PasswordManager.cs +++ b/SecureCore/Authentication/PasswordManager.cs @@ -58,23 +58,17 @@ namespace SecureCore.Authentication } } - public static string HashStringData(string data, byte[] salt = null) - { - return data; - - if (salt == null) salt = new byte[0]; - - return GetHash(data, salt); - } - public static string HashStringData(string data, string salt = "") { - return data; - var saltBytes = new byte[0]; if(!string.IsNullOrEmpty(salt)) saltBytes = Convert.FromBase64String(salt); + else + { + saltBytes = new byte[SaltSize]; + ByteGenerator.GetRandomBytes(ref saltBytes); + } return GetHash(data, saltBytes); } diff --git a/SecureCore/Controllers/AuthController.cs b/SecureCore/Controllers/AuthController.cs index 7a58c7f..44cb7c7 100644 --- a/SecureCore/Controllers/AuthController.cs +++ b/SecureCore/Controllers/AuthController.cs @@ -16,11 +16,17 @@ namespace SecureCore.Controllers { [HttpPost("login")] [AcceptVerbs("POST")] - public IActionResult Login(LoginInfo info) + public IActionResult Login([FromBody] LoginInfo info) { - //NOTE: password length should be a most 64 - 128 characters long. + //NOTE: password length should be at most 64 - 128 characters long. //Very the user has login data. - if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds"); + //if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds"); + + if (HttpContext.Request.Cookies.ContainsKey("Session")) + { + if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName)) + return Ok($"Session is live{Environment.NewLine}"); + } var (password, salt) = UserDataService.GetUserPasswordHash(info.UserName); var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent]; @@ -28,17 +34,11 @@ namespace SecureCore.Controllers if (PasswordManager.PasswordIsValid(info.Password, salt, password)) { - if (HttpContext.Request.Cookies.ContainsKey("Session")) - { - if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName)) - return Ok($"Session is live{Environment.NewLine}"); - } - var session = new SessionManager(); var sessionToken = session.CreateSessionToken(); - UserDataService.SetUserSessionToken(UserDataService.GetUserId(info.UserName), sessionToken, DateTime.Now.AddDays(7), agent, ip); + UserDataService.SetUserSessionToken(info.UserName, sessionToken, DateTime.Now.AddDays(7), agent, ip); HttpContext.Response.Cookies.Append("Session", sessionToken, GetCookieOptions()); @@ -52,7 +52,7 @@ namespace SecureCore.Controllers [HttpPost("Register")] [AcceptVerbs("POST")] - public IActionResult Register(LoginInfo info) + public IActionResult Register([FromBody] LoginInfo info) { var (hash, salt) = PasswordManager.HashPassword(info.Password); var session = new SessionManager(); @@ -76,15 +76,43 @@ namespace SecureCore.Controllers [HttpPost("Logout")] [AcceptVerbs("POST")] - public IActionResult Logout(LoginInfo info) + public IActionResult Logout() { - UserDataService.DestorySession(HttpContext.Request.Cookies["Session"]); + UserDataService.DestroySession(HttpContext.Request.Cookies["Session"]); HttpContext.Response.Cookies.Delete("Session"); return Ok(); } + [HttpGet("ResetPassword")] + //[AcceptVerbs("GET")] + public IActionResult ResetPassword([FromQuery] string token) + { + return Ok("Done"); + } + + [HttpPost("CreatePasswordResetLink")] + [AcceptVerbs("POST")] + public IActionResult CreatePasswordResetLink([FromBody] string userName) + { + var sessionManager = new SessionManager(); + var token = sessionManager.CreateSessionToken(); + var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent]; + var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString()); + + try + { + UserDataService.SetUserSessionToken(userName, token, DateTime.Now.AddHours(1), agent, ip, true); + + return Ok($"192.168.255.200:5000/auth/ResetPassword?{token}{Environment.NewLine}"); + } + catch(Exception e) + { + return Unauthorized($"{e.Message}{Environment.NewLine}"); + } + } + private CookieOptions GetCookieOptions() { return new CookieOptions diff --git a/SecureCore/Services/UserDataService.cs b/SecureCore/Services/UserDataService.cs index eeedaa2..f2f37a7 100644 --- a/SecureCore/Services/UserDataService.cs +++ b/SecureCore/Services/UserDataService.cs @@ -84,17 +84,18 @@ namespace SecureCore.Services } } - public static void SetUserSessionToken(int userId, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress) + public static void SetUserSessionToken(string userName, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress, bool isResetToken = false) { using (var connection = new SqlConnection(ConnectionString)) { - using (var command = new SqlCommand("INSERT INTO [Session]([Session Token], [Expiration Date], [User ID], [User Agent], [IP Address]) VALUES (@SessionToken, @ExpirationDate, @UserKey, @UserAgent, @IpAddress)", connection)) + using (var command = new SqlCommand("InsertSessionToken", connection) { CommandType = CommandType.StoredProcedure }) { command.Parameters.AddWithValue("SessionToken", sessionToken); command.Parameters.AddWithValue("ExpirationDate", expirationDate); - command.Parameters.AddWithValue("UserKey", userId); + command.Parameters.AddWithValue("UserName", userName); command.Parameters.AddWithValue("UserAgent", userAgent); command.Parameters.AddWithValue("IpAddress", ipAddress); + command.Parameters.AddWithValue("PendingReset", isResetToken); connection.Open(); @@ -131,10 +132,9 @@ namespace SecureCore.Services { using (var connection = new SqlConnection(ConnectionString)) { - using (var command = new SqlCommand("SELECT 1 AS Valid WHERE EXISTS(SELECT 1 FROM Session WHERE [Session Token] = @SessionToken)", connection))// AND[User ID] = @UserId)", connection)) + using (var command = new SqlCommand("ValidateSessionToken", connection) { CommandType = CommandType.StoredProcedure }) { command.Parameters.AddWithValue("SessionToken", sessionToken); - //command.Parameters.AddWithValue("UserId", GetUserId(userName)); connection.Open(); @@ -145,11 +145,11 @@ namespace SecureCore.Services } } - public static void DestorySession(string sessionToken) + public static void DestroySession(string sessionToken) { using (var connection = new SqlConnection(ConnectionString)) { - using (var command = new SqlCommand("DELETE FROM [Session] WHERE [Session Token] = @SessionToken", connection)) + using (var command = new SqlCommand("DestroySession", connection) { CommandType = CommandType.StoredProcedure }) { command.Parameters.AddWithValue("SessionToken", sessionToken); @@ -159,5 +159,20 @@ namespace SecureCore.Services } } } + + //public static void ResetPassword(string email) + //{ + // using (var connection = new SqlConnection(ConnectionString)) + // { + // using (var command = new SqlCommand("DestroySession", connection) { CommandType = CommandType.StoredProcedure }) + // { + // command.Parameters.AddWithValue("SessionToken", sessionToken); + + // connection.Open(); + + // command.ExecuteNonQuery(); + // } + // } + //} } }