Updated the Startup.cs to forward headers, hopefully this will help with making sure remote IPs are correctly retrieved.

SecureCore/AppSettingsManager.cs

@@ -0,0 +1,33 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using System.IO;
+using Microsoft.Extensions.Configuration;
+//using Microsoft.Extensions.Configuration.Binder;
+
+namespace SecureCore
+{
+    public static class AppSettingsManager
+    {
+        public static bool TryGetConnectionStringByName(string connectionStringName, out string connectionString)
+        {
+            connectionString = string.Empty;
+
+            try
+            {
+                // You could either use this 
+                var builder = new ConfigurationBuilder()
+                    .SetBasePath(Directory.GetCurrentDirectory())
+                    .AddJsonFile("appsettings.json")
+                    .Build();
+
+                connectionString = builder.GetConnectionString(connectionStringName);
+
+                if (!string.IsNullOrEmpty(connectionString)) return true;
+                else return false;
+            }
+            catch { return false; }
+        }
+    }
+}

SecureCore/Authentication/PasswordManager.cs

@@ -60,6 +60,8 @@ namespace SecureCore.Authentication
 
         public static string HashStringData(string data, byte[] salt = null)
         {
+            return data;
+
             if (salt == null) salt = new byte[0];
 
             return GetHash(data, salt);
@@ -67,6 +69,8 @@ namespace SecureCore.Authentication
 
         public static string HashStringData(string data, string salt = "")
         {
+            return data;
+
             var saltBytes = new byte[0];
 
             if(!string.IsNullOrEmpty(salt))

SecureCore/Authentication/SessionManager.cs

@@ -1,4 +1,5 @@
 using System;
+using System.Data.SqlClient;
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
@@ -7,9 +8,18 @@ namespace SecureCore.Authentication
 {
     public class SessionManager
     {
-        private static int SessionKeySize { get; } = 32; //32 bytes
+        private int SessionKeySize { get; } = 64; //n bytes
+        private string ConnectionString { get; set; }
 
-        public static string CreateSessionToken()
+        public SessionManager()
+        {
+            if (AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connection))
+                ConnectionString = connection;
+            else
+                throw new Exception("Failed to get connection string.");
+        }
+
+        public string CreateSessionToken()
         {
             var token = new byte[SessionKeySize];
 
@@ -17,5 +27,14 @@ namespace SecureCore.Authentication
 
             return Convert.ToBase64String(token);
         }
+
+        //public string CreatePasswordRecoveryKey(string userName)
+        //{
+
+        //    using (var connection = new SqlConnection(ConnectionString))
+        //    {
+
+        //    }
+        //}
     }
 }

SecureCore/Controllers/AuthController.cs

@@ -18,12 +18,13 @@ namespace SecureCore.Controllers
         [AcceptVerbs("POST")]
         public IActionResult Login(LoginInfo info)
         {
+            //NOTE: password length should be a most 64 - 128 characters long.
             //Very the user has login data.
             if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds");
 
             var (password, salt) = UserDataService.GetUserPasswordHash(info.UserName);
             var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
-            var ip = PasswordManager.HashStringData(HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
+            var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
 
             if (PasswordManager.PasswordIsValid(info.Password, salt, password))
             {
@@ -33,7 +34,9 @@ namespace SecureCore.Controllers
                         return Ok($"Session is live{Environment.NewLine}");
                 }
 
-                var sessionToken = SessionManager.CreateSessionToken();
+                var session = new SessionManager();
+
+                var sessionToken = session.CreateSessionToken();
 
                 UserDataService.SetUserSessionToken(UserDataService.GetUserId(info.UserName), sessionToken, DateTime.Now.AddDays(7), agent, ip);
 
@@ -52,9 +55,10 @@ namespace SecureCore.Controllers
         public IActionResult Register(LoginInfo info)
         {
             var (hash, salt) =  PasswordManager.HashPassword(info.Password);
-            var sessionToken = SessionManager.CreateSessionToken();
+            var session = new SessionManager();
+            var sessionToken = session.CreateSessionToken();
             var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
-            var ip = PasswordManager.HashStringData(HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
+            var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
 
             try
             {

SecureCore/Startup.cs

@@ -4,12 +4,8 @@ using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
-using Microsoft.Extensions.Logging;
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Threading.Tasks;
-using SecureCore.Models;
+using Microsoft.AspNetCore.HttpOverrides;
+using System.Net;
 using SecureCore.Services;
 
 namespace SecureCore
@@ -28,6 +24,12 @@ namespace SecureCore
         {
             services.AddTransient<IDataService, DataService>();
             services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Latest);
+            //For more details on this setup consult the docs here: https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-3.1
+            services.Configure<ForwardedHeadersOptions>(options =>
+            {
+                options.ForwardedHeaders =
+                    ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
+            });
         }
 
         // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
@@ -38,6 +40,8 @@ namespace SecureCore
                 app.UseDeveloperExceptionPage();
             }
 
+            app.UseForwardedHeaders();
+
             app.UseRouting();
 
             app.UseAuthorization();

SecureCore/appsettings.json

@@ -7,5 +7,7 @@
     }
   },
   "AllowedHosts": "*",
-  "ConnectionString": "Server=DESKTOP-OEDDVKC\\SQLEXPRESS;Database=main;Integrated Security=true;"
+  "ConnectionStrings": {
+    "MainDataConnectionString": "Server=DESKTOP-OEDDVKC\\SQLEXPRESS;Database=main;Integrated Security=true;"
+  }
 }

SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.CoreCompileInputs.cache

@@ -1 +0,0 @@
-390c9f5585bc7dcf8f0c5f65f443d23f17063571