diff --git a/.vs/SecureCore/v16/.suo b/.vs/SecureCore/v16/.suo index c4dc54f..5da4668 100644 Binary files a/.vs/SecureCore/v16/.suo and b/.vs/SecureCore/v16/.suo differ diff --git a/SecureCore/AppSettingsManager.cs b/SecureCore/AppSettingsManager.cs new file mode 100644 index 0000000..fce2ab7 --- /dev/null +++ b/SecureCore/AppSettingsManager.cs @@ -0,0 +1,33 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Threading.Tasks; +using System.IO; +using Microsoft.Extensions.Configuration; +//using Microsoft.Extensions.Configuration.Binder; + +namespace SecureCore +{ + public static class AppSettingsManager + { + public static bool TryGetConnectionStringByName(string connectionStringName, out string connectionString) + { + connectionString = string.Empty; + + try + { + // You could either use this + var builder = new ConfigurationBuilder() + .SetBasePath(Directory.GetCurrentDirectory()) + .AddJsonFile("appsettings.json") + .Build(); + + connectionString = builder.GetConnectionString(connectionStringName); + + if (!string.IsNullOrEmpty(connectionString)) return true; + else return false; + } + catch { return false; } + } + } +} diff --git a/SecureCore/Authentication/PasswordManager.cs b/SecureCore/Authentication/PasswordManager.cs index 7a22d57..be4877b 100644 --- a/SecureCore/Authentication/PasswordManager.cs +++ b/SecureCore/Authentication/PasswordManager.cs @@ -60,6 +60,8 @@ namespace SecureCore.Authentication public static string HashStringData(string data, byte[] salt = null) { + return data; + if (salt == null) salt = new byte[0]; return GetHash(data, salt); @@ -67,6 +69,8 @@ namespace SecureCore.Authentication public static string HashStringData(string data, string salt = "") { + return data; + var saltBytes = new byte[0]; if(!string.IsNullOrEmpty(salt)) diff --git a/SecureCore/Authentication/SessionManager.cs b/SecureCore/Authentication/SessionManager.cs index 9381245..53de0b2 100644 --- a/SecureCore/Authentication/SessionManager.cs +++ b/SecureCore/Authentication/SessionManager.cs @@ -1,4 +1,5 @@ using System; +using System.Data.SqlClient; using System.Collections.Generic; using System.Linq; using System.Threading.Tasks; @@ -7,9 +8,18 @@ namespace SecureCore.Authentication { public class SessionManager { - private static int SessionKeySize { get; } = 32; //32 bytes + private int SessionKeySize { get; } = 64; //n bytes + private string ConnectionString { get; set; } - public static string CreateSessionToken() + public SessionManager() + { + if (AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connection)) + ConnectionString = connection; + else + throw new Exception("Failed to get connection string."); + } + + public string CreateSessionToken() { var token = new byte[SessionKeySize]; @@ -17,5 +27,14 @@ namespace SecureCore.Authentication return Convert.ToBase64String(token); } + + //public string CreatePasswordRecoveryKey(string userName) + //{ + + // using (var connection = new SqlConnection(ConnectionString)) + // { + + // } + //} } } diff --git a/SecureCore/Controllers/AuthController.cs b/SecureCore/Controllers/AuthController.cs index dfaf438..7a58c7f 100644 --- a/SecureCore/Controllers/AuthController.cs +++ b/SecureCore/Controllers/AuthController.cs @@ -18,12 +18,13 @@ namespace SecureCore.Controllers [AcceptVerbs("POST")] public IActionResult Login(LoginInfo info) { + //NOTE: password length should be a most 64 - 128 characters long. //Very the user has login data. if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds"); var (password, salt) = UserDataService.GetUserPasswordHash(info.UserName); var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent]; - var ip = PasswordManager.HashStringData(HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt); + var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt); if (PasswordManager.PasswordIsValid(info.Password, salt, password)) { @@ -33,7 +34,9 @@ namespace SecureCore.Controllers return Ok($"Session is live{Environment.NewLine}"); } - var sessionToken = SessionManager.CreateSessionToken(); + var session = new SessionManager(); + + var sessionToken = session.CreateSessionToken(); UserDataService.SetUserSessionToken(UserDataService.GetUserId(info.UserName), sessionToken, DateTime.Now.AddDays(7), agent, ip); @@ -52,9 +55,10 @@ namespace SecureCore.Controllers public IActionResult Register(LoginInfo info) { var (hash, salt) = PasswordManager.HashPassword(info.Password); - var sessionToken = SessionManager.CreateSessionToken(); + var session = new SessionManager(); + var sessionToken = session.CreateSessionToken(); var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent]; - var ip = PasswordManager.HashStringData(HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt); + var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt); try { diff --git a/SecureCore/Startup.cs b/SecureCore/Startup.cs index b0fbc97..ea17aaf 100644 --- a/SecureCore/Startup.cs +++ b/SecureCore/Startup.cs @@ -4,12 +4,8 @@ using Microsoft.AspNetCore.Mvc; using Microsoft.Extensions.Configuration; using Microsoft.Extensions.DependencyInjection; using Microsoft.Extensions.Hosting; -using Microsoft.Extensions.Logging; -using System; -using System.Collections.Generic; -using System.Linq; -using System.Threading.Tasks; -using SecureCore.Models; +using Microsoft.AspNetCore.HttpOverrides; +using System.Net; using SecureCore.Services; namespace SecureCore @@ -28,6 +24,12 @@ namespace SecureCore { services.AddTransient(); services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Latest); + //For more details on this setup consult the docs here: https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-3.1 + services.Configure(options => + { + options.ForwardedHeaders = + ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto; + }); } // This method gets called by the runtime. Use this method to configure the HTTP request pipeline. @@ -38,6 +40,8 @@ namespace SecureCore app.UseDeveloperExceptionPage(); } + app.UseForwardedHeaders(); + app.UseRouting(); app.UseAuthorization(); diff --git a/SecureCore/appsettings.json b/SecureCore/appsettings.json index e77600c..dbaf363 100644 --- a/SecureCore/appsettings.json +++ b/SecureCore/appsettings.json @@ -7,5 +7,7 @@ } }, "AllowedHosts": "*", - "ConnectionString": "Server=DESKTOP-OEDDVKC\\SQLEXPRESS;Database=main;Integrated Security=true;" + "ConnectionStrings": { + "MainDataConnectionString": "Server=DESKTOP-OEDDVKC\\SQLEXPRESS;Database=main;Integrated Security=true;" + } } diff --git a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.CoreCompileInputs.cache b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.CoreCompileInputs.cache deleted file mode 100644 index 20b0a63..0000000 --- a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.CoreCompileInputs.cache +++ /dev/null @@ -1 +0,0 @@ -390c9f5585bc7dcf8f0c5f65f443d23f17063571 diff --git a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csprojAssemblyReference.cache b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csprojAssemblyReference.cache deleted file mode 100644 index 387fd51..0000000 Binary files a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csprojAssemblyReference.cache and /dev/null differ diff --git a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.dll b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.dll deleted file mode 100644 index 6464bac..0000000 Binary files a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.dll and /dev/null differ diff --git a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.pdb b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.pdb deleted file mode 100644 index 70585a7..0000000 Binary files a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.pdb and /dev/null differ