Added some minor tweaks, and set up the EmployeeController to be usable by a frontend to see how well all this works so far.

SecureCore/Authentication/SessionManager.cs

@@ -1,12 +1,14 @@
 using System;
 using System.Data;
 using System.Data.SqlClient;
+using Microsoft.AspNetCore.Http;
 
 namespace SecureCore.Authentication
 {
     public static class SessionManager
     {
         private static int SessionKeySize { get; } = 64; //n bytes
+        public static string SessionCookieName { get; } = "Session";
 
         public static string CreateSessionToken()
         {
@@ -32,6 +34,15 @@ namespace SecureCore.Authentication
             return Convert.ToBoolean(result);
         }
 
+        public static bool IsSessionTokenValid(HttpContext context)
+        {
+            AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
+
+            if (!context.Request.Cookies.ContainsKey(SessionCookieName)) return false;
+
+            return IsSessionTokenValid(context.Request.Cookies[SessionCookieName], connectionString);
+        }
+
         public static void Logout(string sessionToken, string connectionString)
         {
             using var connection = new SqlConnection(connectionString);

SecureCore/Controllers/AuthController.cs

@@ -20,9 +20,8 @@ namespace SecureCore.Controllers
             
             try
             {
-                if (HttpContext.Request.Cookies.ContainsKey("Session"))
+                if (SessionManager.IsSessionTokenValid(HttpContext))
-                    if (SessionManager.IsSessionTokenValid(HttpContext.Request.Cookies["Session"], connectionString))
+                    return Ok("Logged in\n");
-                        return Ok("Logged in\n");
 
                 //Verify that the username provided is valid, i.e. no whitespace, special characters, etc.
                 var result = UserDataService.IsUsernameValid(info.Username);
@@ -47,7 +46,7 @@ namespace SecureCore.Controllers
 
                 SessionManager.Login(info.Username, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString);
 
-                HttpContext.Response.Cookies.Append("Session", sessionToken, cookieOptions);
+                HttpContext.Response.Cookies.Append(SessionManager.SessionCookieName, sessionToken, cookieOptions);
 
                 return Ok($"Logged in success{Environment.NewLine}");
             }
@@ -89,7 +88,7 @@ namespace SecureCore.Controllers
 
                 var i = UserDataService.RegisterNewUser(info.Username, info.Email, hash, salt, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString);
 
-                HttpContext.Response.Cookies.Append("Session", sessionToken, cookieOptions);
+                HttpContext.Response.Cookies.Append(SessionManager.SessionCookieName, sessionToken, cookieOptions);
 
                 return Ok($"New User ID: {i}");
             }
@@ -109,14 +108,14 @@ namespace SecureCore.Controllers
 
             try
             {
-                SessionManager.Logout(HttpContext.Request.Cookies["Session"], connectionString);
+                SessionManager.Logout(HttpContext.Request.Cookies[SessionManager.SessionCookieName], connectionString);
             }
             catch(Exception e)
             {
                 //TODO: decide what to do here. If the SQL fails to clear the token from the database, do we want to clear the token cookie?
             }
 
-            HttpContext.Response.Cookies.Delete("Session");
+            HttpContext.Response.Cookies.Delete(SessionManager.SessionCookieName);
 
             return Ok();
         }

SecureCore/Controllers/EmployeeController.cs

@@ -24,19 +24,19 @@ namespace SecureCore.Controllers
         [HttpGet]
         public IActionResult Get()
         {
-            //if (Authentication.IsAllowed(HttpContext))
+            if(SessionManager.IsSessionTokenValid(HttpContext))
-            return Ok(DataService.Get());
+                return Ok(DataService.Get());
-            //else
+            else
-            //    return Unauthorized();
+               return Unauthorized();
         }
 
         [HttpGet("{id}", Name = "Get")]
         public IActionResult Get(int id)
         {
-            //if (Authentication.IsAllowed(HttpContext))
+            if (SessionManager.IsSessionTokenValid(HttpContext))
-            return Ok(DataService.GetById(id));
+                return Ok(DataService.GetById(id));
-            //else
+            else
-            //    return Unauthorized();
+                return Unauthorized();
         }
     }