secure-core/SecureCore/Authentication/SessionManager.cs

using System;
using System.Data;
using System.Data.SqlClient;
using Microsoft.AspNetCore.Http;

namespace SecureCore.Authentication
{
    public static class SessionManager
    {
        private static int SessionKeySize { get; } = 64; //n bytes
        public static string SessionCookieName { get; } = "Session";

        public static string CreateSessionToken()
        {
            var token = new byte[SessionKeySize];

            ByteGenerator.GetRandomBytes(ref token);

            return Convert.ToBase64String(token);
        }

        public static bool IsSessionTokenValid(string sessionToken, string connectionString, bool isResetToken = false)
        {
            using var connection = new SqlConnection(connectionString);
            using var command = new SqlCommand("ValidateSessionToken", connection) { CommandType = CommandType.StoredProcedure };

            command.Parameters.AddWithValue("SessionToken", sessionToken);
            command.Parameters.AddWithValue("IsResetToken", isResetToken);

            connection.Open();

            var result = command.ExecuteScalar();

            return Convert.ToBoolean(result);
        }

        public static bool IsSessionTokenValid(HttpContext context)
        {
            AppSettingsManager.TryGetConnectionString("MainDataConnectionString", out string connectionString);

            if (!context.Request.Cookies.ContainsKey(SessionCookieName)) return false;

            return IsSessionTokenValid(context.Request.Cookies[SessionCookieName], connectionString);
        }

        public static void Logout(string sessionToken, string connectionString)
        {
            using var connection = new SqlConnection(connectionString);
            using var command = new SqlCommand("LogoutUser", connection) { CommandType = CommandType.StoredProcedure };

            command.Parameters.AddWithValue("SessionToken", sessionToken);

            connection.Open();

            command.ExecuteNonQuery();
        }

        public static void Login(string userName, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress, string connectionString)
        {
            using var connection = new SqlConnection(connectionString);
            using var command = new SqlCommand("LoginUser", connection) { CommandType = CommandType.StoredProcedure };

            command.Parameters.AddWithValue("SessionToken", sessionToken);
            command.Parameters.AddWithValue("ExpirationDate", expirationDate);
            command.Parameters.AddWithValue("UserName", userName);
            command.Parameters.AddWithValue("UserAgent", userAgent);
            command.Parameters.AddWithValue("IpAddress", ipAddress);

            connection.Open();

            command.ExecuteNonQuery();
        }
    }
}