glm94/secure-core
1
0
Fork 0
Code Issues 9 Pull Requests Releases Wiki Activity

Added the first part of allowing the user to reset their password.

Browse Source
This commit is contained in:
glm94
2021-01-08 00:00:58 -06:00
parent fb61c971e9
commit d495bfca9c
5 changed files with 68 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SecureCore/Controllers/AuthController.cs
+41 -13
View File
@@ -16,11 +16,17 @@ namespace SecureCore.Controllers
{
[HttpPost("login")]
[AcceptVerbs("POST")]
public IActionResult Login(LoginInfo info)
public IActionResult Login([FromBody] LoginInfo info)
{
//NOTE: password length should be a most 64 - 128 characters long.
//NOTE: password length should be at most 64 - 128 characters long.
//Very the user has login data.
if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds");
//if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds");
if (HttpContext.Request.Cookies.ContainsKey("Session"))
{
if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName))
return Ok($"Session is live{Environment.NewLine}");
}
var (password, salt) = UserDataService.GetUserPasswordHash(info.UserName);
var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
@@ -28,17 +34,11 @@ namespace SecureCore.Controllers
if (PasswordManager.PasswordIsValid(info.Password, salt, password))
{
if (HttpContext.Request.Cookies.ContainsKey("Session"))
{
if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName))
return Ok($"Session is live{Environment.NewLine}");
}
var session = new SessionManager();
var sessionToken = session.CreateSessionToken();
UserDataService.SetUserSessionToken(UserDataService.GetUserId(info.UserName), sessionToken, DateTime.Now.AddDays(7), agent, ip);
UserDataService.SetUserSessionToken(info.UserName, sessionToken, DateTime.Now.AddDays(7), agent, ip);
HttpContext.Response.Cookies.Append("Session", sessionToken, GetCookieOptions());
@@ -52,7 +52,7 @@ namespace SecureCore.Controllers
[HttpPost("Register")]
[AcceptVerbs("POST")]
public IActionResult Register(LoginInfo info)
public IActionResult Register([FromBody] LoginInfo info)
{
var (hash, salt) = PasswordManager.HashPassword(info.Password);
var session = new SessionManager();
@@ -76,15 +76,43 @@ namespace SecureCore.Controllers
[HttpPost("Logout")]
[AcceptVerbs("POST")]
public IActionResult Logout(LoginInfo info)
public IActionResult Logout()
{
UserDataService.DestorySession(HttpContext.Request.Cookies["Session"]);
UserDataService.DestroySession(HttpContext.Request.Cookies["Session"]);
HttpContext.Response.Cookies.Delete("Session");
return Ok();
}
[HttpGet("ResetPassword")]
//[AcceptVerbs("GET")]
public IActionResult ResetPassword([FromQuery] string token)
{
return Ok("Done");
}
[HttpPost("CreatePasswordResetLink")]
[AcceptVerbs("POST")]
public IActionResult CreatePasswordResetLink([FromBody] string userName)
{
var sessionManager = new SessionManager();
var token = sessionManager.CreateSessionToken();
var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString());
try
{
UserDataService.SetUserSessionToken(userName, token, DateTime.Now.AddHours(1), agent, ip, true);
return Ok($"192.168.255.200:5000/auth/ResetPassword?{token}{Environment.NewLine}");
}
catch(Exception e)
{
return Unauthorized($"{e.Message}{Environment.NewLine}");
}
}
private CookieOptions GetCookieOptions()
{
return new CookieOptions