glm94/secure-core
1
0
Fork 0
Code Issues 9 Pull Requests Releases Wiki Activity

Updated the Startup.cs to forward headers, hopefully this will help with making sure remote IPs are correctly retrieved.

Browse Source
This commit is contained in:
glm94
2021-01-05 21:52:09 -06:00
parent 9d70df80f1
commit fb61c971e9
11 changed files with 79 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SecureCore/Controllers/AuthController.cs
+8 -4
View File
@@ -18,12 +18,13 @@ namespace SecureCore.Controllers
[AcceptVerbs("POST")]
public IActionResult Login(LoginInfo info)
{
//NOTE: password length should be a most 64 - 128 characters long.
//Very the user has login data.
if (!UserDataService.UserHasLoginData(info.UserName)) return Unauthorized("User doesn't have login creds");
var (password, salt) = UserDataService.GetUserPasswordHash(info.UserName);
var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
var ip = PasswordManager.HashStringData(HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
if (PasswordManager.PasswordIsValid(info.Password, salt, password))
{
@@ -33,7 +34,9 @@ namespace SecureCore.Controllers
return Ok($"Session is live{Environment.NewLine}");
}
var sessionToken = SessionManager.CreateSessionToken();
var session = new SessionManager();
var sessionToken = session.CreateSessionToken();
UserDataService.SetUserSessionToken(UserDataService.GetUserId(info.UserName), sessionToken, DateTime.Now.AddDays(7), agent, ip);
@@ -52,9 +55,10 @@ namespace SecureCore.Controllers
public IActionResult Register(LoginInfo info)
{
var (hash, salt) = PasswordManager.HashPassword(info.Password);
var sessionToken = SessionManager.CreateSessionToken();
var session = new SessionManager();
var sessionToken = session.CreateSessionToken();
var agent = HttpContext.Request.Headers[Microsoft.Net.Http.Headers.HeaderNames.UserAgent];
var ip = PasswordManager.HashStringData(HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
var ip = PasswordManager.HashStringData(Request.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), salt);
try
{