Updated the Startup.cs to forward headers, hopefully this will help with making sure remote IPs are correctly retrieved.

SecureCore/Authentication/SessionManager.cs

@@ -1,4 +1,5 @@
 using System;
+using System.Data.SqlClient;
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
@@ -7,9 +8,18 @@ namespace SecureCore.Authentication
 {
     public class SessionManager
     {
-        private static int SessionKeySize { get; } = 32; //32 bytes
+        private int SessionKeySize { get; } = 64; //n bytes
+        private string ConnectionString { get; set; }
 
-        public static string CreateSessionToken()
+        public SessionManager()
+        {
+            if (AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connection))
+                ConnectionString = connection;
+            else
+                throw new Exception("Failed to get connection string.");
+        }
+
+        public string CreateSessionToken()
         {
             var token = new byte[SessionKeySize];
 
@@ -17,5 +27,14 @@ namespace SecureCore.Authentication
 
             return Convert.ToBase64String(token);
         }
+
+        //public string CreatePasswordRecoveryKey(string userName)
+        //{
+
+        //    using (var connection = new SqlConnection(ConnectionString))
+        //    {
+
+        //    }
+        //}
     }
 }