Changed the settings getting functions to accept a fll key path instead of only a Section / Key pair. Changed the placement of the pepper in the password hashing function to be in complicance with the OWASP's recommendation for using a pwpper.

2021-03-29 19:15:15 -05:00
parent 9b283b31f4
commit f5ee2f68b9
5 changed files with 25 additions and 12 deletions
@@ -12,7 +12,12 @@ namespace SecureCore.Controllers
    [ApiController]
    public class AuthController : Controller
    {
-        public static string BaseUrl { get; set; }
+        [HttpPost("IsLoggedIn")]
+        [AcceptVerbs("POST")]
+        public IActionResult IsLoggedIn()
+        {
+            return Ok();
+        }
        //TODO: Login will only ever return messages like "Wrong username / password." whereas register can return messages like "User exists.", "Password to weak", or "Password in top 100 most used.".
        [HttpPost("login")]
        [AcceptVerbs("POST")]
@@ -167,9 +172,11 @@ namespace SecureCore.Controllers
            {
                PasswordManager.InsertPasswordResetRequest(email, token, DateTime.Now.AddHours(1), agent, ip, connectionString);

+                AppSettingsManager.TryGetSettingString("PasswordSettings.BaseURL", out string baseAddress);
+
                token = HttpUtility.UrlEncode(token);
                //TODO: Email the link to the supplied email.
-                return Ok($"192.168.255.200:5000/auth/ResetPassword?token={token}{Environment.NewLine}");
+                return Ok($"{baseAddress}/ResetPassword?token={token}{Environment.NewLine}");
            }
            catch(Exception e)
            {
@@ -177,6 +184,11 @@ namespace SecureCore.Controllers
            }
        }

+        //TODO: Review https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-5.0 and https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
+        /// <summary>
+        /// 
+        /// </summary>
+        /// <returns></returns>
        private CookieOptions GetCookieOptions()
        {
            return new CookieOptions