Started to try and organize all the authentication code.

SecureCore/Controllers/AuthController.cs

@@ -6,6 +6,7 @@ using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
 using SecureCore.Services;
+using SecureCore.Authentication;
 
 namespace SecureCore.Controllers
 {
@@ -17,9 +18,12 @@ namespace SecureCore.Controllers
         [AcceptVerbs("POST")]
         public IActionResult Login(LoginInfo info)
         {
+            //Very the user has login data.
+            if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds");
+
             var (password, saltHash) = UserDataService.GetUserPasswordHash(info.UserName);
 
-            if (Authentication.PasswordIsValid(info.Password, saltHash, password))
+            if (PasswordManager.PasswordIsValid(info.Password, saltHash, password))
             {
                 if (HttpContext.Request.Cookies.ContainsKey("Session"))
                 {
@@ -27,7 +31,7 @@ namespace SecureCore.Controllers
                         return Ok($"Session is live{Environment.NewLine}");
                 }
 
-                var sessionToken = Authentication.CreateSessionToken();
+                var sessionToken = SessionManager.CreateSessionToken();
 
                 UserDataService.SetUserSessionToken(UserDataService.GetUserId(info.UserName), sessionToken, DateTime.Now.AddDays(7));
 
@@ -45,8 +49,8 @@ namespace SecureCore.Controllers
         [AcceptVerbs("POST")]
         public IActionResult Register(LoginInfo info)
         {
-            var (hash, salt) = Authentication.HashPassword(info.Password);
-            var sessionToken = Authentication.CreateSessionToken();
+            var (hash, salt) =  PasswordManager.HashPassword(info.Password);
+            var sessionToken = SessionManager.CreateSessionToken();
 
             try
             {
@@ -62,6 +66,17 @@ namespace SecureCore.Controllers
             }
         }
 
+        [HttpPost("Logout")]
+        [AcceptVerbs("POST")]
+        public IActionResult Logout(LoginInfo info)
+        {
+            UserDataService.DestorySession(HttpContext.Request.Cookies["Session"]);
+
+            HttpContext.Response.Cookies.Delete("Session");
+
+            return Ok();
+        }
+
         private CookieOptions GetCookieOptions()
         {
             return new CookieOptions
@@ -76,6 +91,13 @@ namespace SecureCore.Controllers
         }
     }
 
+    public class LoginInfo
+    {
+        public string UserName { get; set; }
+        public string Password { get; set; }
+        public string Email { get; set; }
+    }
+
     //TODO: Read more https://www.valentinog.com/blog/cookies/
     // And this https://blog.webf.zone/ultimate-guide-to-http-cookies-2aa3e083dbae
 }

SecureCore/Controllers/EmployeeController.cs

@@ -5,8 +5,7 @@ using System.Collections.Generic;
 using System.Linq;
 using System.Text;
 using SecureCore.Services;
-using System.Security.Cryptography;
-using Microsoft.AspNetCore.Cryptography.KeyDerivation;
+using SecureCore.Authentication;
 
 namespace SecureCore.Controllers
 {
@@ -25,19 +24,19 @@ namespace SecureCore.Controllers
         [HttpGet]
         public IActionResult Get()
         {
-            if (Authentication.IsAllowed(HttpContext))
-                return Ok(DataService.Get());
-            else
-                return Unauthorized();
+            //if (Authentication.IsAllowed(HttpContext))
+            return Ok(DataService.Get());
+            //else
+            //    return Unauthorized();
         }
 
         [HttpGet("{id}", Name = "Get")]
         public IActionResult Get(int id)
         {
-            if (Authentication.IsAllowed(HttpContext))
-                return Ok(DataService.GetById(id));
-            else
-                return Unauthorized();
+            //if (Authentication.IsAllowed(HttpContext))
+            return Ok(DataService.GetById(id));
+            //else
+            //    return Unauthorized();
         }
     }