glm94/secure-core
1
0
Fork 0
Code Issues 9 Pull Requests Releases Wiki Activity

Cleaned up and refactored the code to make things much easier to understand.

Browse Source
This commit is contained in:
glm94
2021-01-13 11:24:19 -06:00
parent 4721a70ea7
commit e198838a32
6 changed files with 149 additions and 267 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SecureCore/Controllers/AuthController.cs
+46 -35
View File
@@ -3,7 +3,7 @@ using Microsoft.AspNetCore.Http;
using System;
using System.Web;
using System.Collections.Generic;
using System.Linq;
using System.Data.SqlClient;
using System.Threading.Tasks;
using SecureCore.Services;
using SecureCore.Authentication;
@@ -19,39 +19,44 @@ namespace SecureCore.Controllers
[AcceptVerbs("POST")]
public IActionResult Login([FromBody] LoginInfo info)
{
//NOTE: password length should be at most 64 - 128 characters long.
//Very the user has login data.
//if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds");
var result = UserDataService.UserNameIsValid(info.UserName);
if (!result.IsValid) return Unauthorized(result.Message);
//if (HttpContext.Request.Cookies.ContainsKey("Session"))
//{
// if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName))
// return Ok($"Session is live{Environment.NewLine}");
//}
var (password, salt) = UserDataService.GetUserPasswordHash(info.UserName);
var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
result = PasswordManager.PasswordIsValid(info.Password, salt, password);
if (result.IsValid)
AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
//TODO: see if the request has an active session key so we don't spam out new keys like mad
try
{
var session = new SessionManager();
//Verify that the username provided is valid, i.e. no whitespace, special characters, etc.
var result = UserDataService.IsUsernameValid(info.UserName);
//If the name isn't valid, return the error message to the user.
if (!result.IsValid) return Unauthorized(result.Message);
var sessionToken = session.CreateSessionToken();
//if (HttpContext.Request.Cookies.ContainsKey("Session"))
//{
// if(UserDataService.IsSessionTokenValid(HttpContext.Request.Cookies["Session"]))//, info.UserName))
// return Ok($"Session is live{Environment.NewLine}");
//}
//Next try to get the user's login data, if the fuction returns empty strings, then the user isn't a registered name.
var (password, salt) = PasswordManager.GetPasswordHashAndSalt(info.UserName, connectionString);
//If the user name isn't in the system, then simply return a generic error message about something not being right.
if (password == string.Empty) return Unauthorized("User name or password is not correct.");
UserDataService.SetUserSessionToken(info.UserName, sessionToken, DateTime.Now.AddDays(7), agent, ip);
result = PasswordManager.IsPasswordValid(info.Password, salt, password);
HttpContext.Response.Cookies.Append("Session", sessionToken, GetCookieOptions());
if (!result.IsValid) return Unauthorized(result.Message);
var sessionToken = SessionManager.CreateSessionToken();
var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
var cookieOptions = GetCookieOptions();
SessionManager.Login(info.UserName, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString);
HttpContext.Response.Cookies.Append("Session", sessionToken, cookieOptions);
return Ok($"Logged in success{Environment.NewLine}");
}
else
catch(Exception ex)
{
return Unauthorized(result.Message);
//TODO: Log this event.
return Unauthorized("An error has occured trying to process your request, please try again in a few minutes.");
}
}
@@ -59,17 +64,19 @@ namespace SecureCore.Controllers
[AcceptVerbs("POST")]
public IActionResult Register([FromBody] LoginInfo info)
{
AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
var (hash, salt) = PasswordManager.HashPassword(info.Password);
var session = new SessionManager();
var sessionToken = session.CreateSessionToken();
var sessionToken = SessionManager.CreateSessionToken();
var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
try
{
var i = UserDataService.RegisterNewUser(info.UserName, info.Email, hash, salt, sessionToken, DateTime.Now.AddDays(7),agent, ip);
var cookieOptions = GetCookieOptions();
HttpContext.Response.Cookies.Append("Session", sessionToken, GetCookieOptions());
var i = UserDataService.RegisterNewUser(info.UserName, info.Email, hash, salt, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString);
HttpContext.Response.Cookies.Append("Session", sessionToken, cookieOptions);
return Ok($"New User ID: {i}");
}
@@ -83,7 +90,9 @@ namespace SecureCore.Controllers
[AcceptVerbs("POST")]
public IActionResult Logout()
{
UserDataService.DestroySession(HttpContext.Request.Cookies["Session"]);
AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
SessionManager.Logout(HttpContext.Request.Cookies["Session"], connectionString);
HttpContext.Response.Cookies.Delete("Session");
@@ -94,9 +103,11 @@ namespace SecureCore.Controllers
//[AcceptVerbs("GET")]
public IActionResult ResetPassword([FromQuery] string token)
{
AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
try
{
if (!UserDataService.IsResetTokenValid(token)) return Unauthorized("Token invalid");
if (!SessionManager.IsSessionTokenValid(token, connectionString, true)) return Unauthorized("Token invalid");
}
catch (Exception e)
@@ -110,14 +121,14 @@ namespace SecureCore.Controllers
[AcceptVerbs("POST")]
public IActionResult CreatePasswordResetLink([FromBody] string userName) //TODO: this sig should only accept an email, so the link can be sent there.
{
var sessionManager = new SessionManager();
var token = sessionManager.CreateSessionToken();
AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
var token = SessionManager.CreateSessionToken();
var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString());
try
{
UserDataService.SetUserSessionToken(userName, token, DateTime.Now.AddHours(1), agent, ip, true);
PasswordManager.InsertPasswordResetRequest(userName, token, DateTime.Now.AddHours(1), agent, ip, connectionString);
token = HttpUtility.UrlEncode(token);