Basic register and login working

Controllers/AuthController.cs

@@ -1,18 +1,14 @@
 using System.Diagnostics;
 using Microsoft.AspNetCore.Mvc;
+using SecureDesignProject.Extensions;
 using SecureDesignProject.Models;
+using SecureDesignProject.Services;
+
 
 namespace SecureDesignProject.Controllers;
 
-public class AuthController : Controller
+public class AuthController(ILogger<HomeController> logger, AuthService authService) : Controller
 {
-    private readonly ILogger<HomeController> _logger;
-
-    public AuthController(ILogger<HomeController> logger)
-    {
-        _logger = logger;
-    }
-
     public IActionResult Login()
     {
         return View();
@@ -23,6 +19,40 @@ public IActionResult Register()
         return View();
     }
 
+    [HttpPost]
+    public IActionResult Login([FromForm] LoginDetails loginDetails)
+    {
+        var loginResult = authService.AttemptLogin(loginDetails);
+
+        if (!loginResult.success)
+        {
+            TempData["errorMsg"] = "Invalid email or password";
+
+            return View();
+        }
+
+        Response.SetSessionKeyCookie(loginResult.sessionKey);
+
+        return RedirectToAction("Index", "Home");
+    }
+
+    [HttpPost]
+    public IActionResult Register([FromForm] RegisterDetails registerDetails)
+    {
+        var createAccountResult = authService.AttemptCreateAccount(registerDetails);
+
+        if (!createAccountResult.success)
+        {
+            TempData["errorMsg"] = "Could not create account with that email.";
+
+            return View();
+        }
+
+        Response.SetSessionKeyCookie(createAccountResult.SessionKey);
+
+        return RedirectToAction("Index", "Home");
+    }
+
     [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
     public IActionResult Error()
     {

Extensions/HttpExtensions.cs

@@ -0,0 +1,15 @@
+namespace SecureDesignProject.Extensions;
+
+public static class HttpExtensions
+{
+    public static void SetSessionKeyCookie(this HttpResponse response, byte[] sessionKey)
+    {
+        var options = new CookieOptions
+        {
+            Expires = DateTime.Now.AddMinutes(60),
+            HttpOnly = true
+        };
+        response.Cookies.Append("session_key", Convert.ToHexString(sessionKey), options);
+
+    }
+}

Extensions/StringExtensions.cs

@@ -0,0 +1,6 @@
+namespace SecureDesignProject.Extensions;
+
+public static class StringExtensions
+{
+    public static bool IsNullOrWhiteSpace(this string? value) => string.IsNullOrWhiteSpace(value);
+}

Middleware/AuthMiddleware.cs

@@ -0,0 +1,45 @@
+using SecureDesignProject.Extensions;
+using SecureDesignProject.Services;
+
+namespace SecureDesignProject.Middleware;
+
+
+public class AuthMiddleware(RequestDelegate next, AuthService authService)
+{
+    public async Task InvokeAsync(HttpContext context)
+    {
+        // skip check and call next middleware if /auth path
+        if (context.Request.Path.StartsWithSegments("/auth"))
+        {
+            await next(context);
+
+            return;
+        }
+
+        // redirect to login page if invalid token
+        var sessionKey = Convert.FromHexString(context.Request.Cookies["session_key"] ?? "");
+        if (sessionKey.Length == 0)
+        {
+            context.Response.Redirect("/auth/login");
+            return;
+        }
+
+        if (!authService.IsValidSession(sessionKey!))
+        {
+            context.Response.Redirect("/auth/login");
+            return;
+        }
+
+        // Call the next delegate/middleware in the pipeline.
+        await next(context);
+    }
+}
+
+public static class AuthMiddlewareExtensions
+{
+    public static IApplicationBuilder UseAuthMiddleware(
+        this IApplicationBuilder builder)
+    {
+        return builder.UseMiddleware<AuthMiddleware>();
+    }
+}

Migrations/1_create_db.sql

@@ -8,7 +8,7 @@ GO
 CREATE TABLE Accounts(
     AccountId UNIQUEIDENTIFIER NOT NULL,
     Email NVARCHAR(MAX) NOT NULL UNIQUE,
-    HashedPassword VARCHAR(MAX) NOT NULL,
+    HashedPassword BINARY(256) NOT NULL,
 
     PRIMARY KEY (AccountId)
 );
@@ -81,7 +81,7 @@ CREATE TABLE Sessions(
     SessionId UNIQUEIDENTIFIER NOT NULL,
     AccountId UNIQUEIDENTIFIER NOT NULL,
 
-    Token VARCHAR(MAX) NOT NULL,
+    SessionKey BINARY(256) NOT NULL,
     IsValid BIT NOT NULL,
 
     Created DATETIME NOT NULL,

Migrations/2_add_seperate_salt_col.sql

@@ -0,0 +1,2 @@
+ALTER TABLE Accounts
+ADD Salt BINARY(128) NOT NULL DEFAULT 123; 

Models/AuthModels.cs

@@ -0,0 +1,68 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace SecureDesignProject.Models;
+
+public record LoginDetails
+{
+    [Required]
+    [MaxLength(255)]
+    public string Email { get; init; } = "";
+
+    [Required]
+    [MaxLength(255)]
+    public string Password { get; init; } = "";
+};
+
+public record RegisterDetails
+{
+    [Required]
+    [MaxLength(255)]
+    public string Email { get; init; } = "";
+
+    [Required]
+    [MaxLength(255)]
+    [MinLength(8)]
+    public string Password { get; init; } = "";
+
+    [Required]
+    [MaxLength(255)]
+    public string FirstName { get; init; } = "";
+
+    [Required]
+    [MaxLength(255)]
+    public string LastName { get; init; } = "";
+
+    [Required]
+    public int InviteCode { get; init; }
+};
+
+public record Account
+{
+    public Guid AccountId { get; init; } = Guid.NewGuid();
+    public string Email { get; init; }
+    public byte[] HashedPassword { get; init; }
+
+    public byte[] Salt { get; init; }
+}
+
+public record Patient
+{
+    public Guid PatientId { get; init; } = Guid.NewGuid();
+    public Guid AccountId { get; init; }
+    public string FirstName { get; init; } = "";
+    public string LastName { get; init; } = "";
+    public string? Address { get; init; }
+}
+
+public record Session
+{
+    public Guid SessionId { get; init; }
+    public Guid AccountId { get; init; }
+
+    public bool IsValid { get; init; }
+    public byte[] SessionKey { get; init; }
+
+    public DateTime Created { get; init; }
+    public DateTime LastSeen { get; init; }
+    public DateTime Expires { get; init; }
+}

Program.cs

@@ -1,7 +1,12 @@
+using SecureDesignProject.Middleware;
+using SecureDesignProject.Services;
+
 var builder = WebApplication.CreateBuilder(args);
 
 // Add services to the container.
 builder.Services.AddControllersWithViews();
+builder.Services.AddSingleton<DatabaseService>();
+builder.Services.AddSingleton<AuthService>();
 
 var app = builder.Build();
 
@@ -18,7 +23,7 @@
 
 app.UseRouting();
 
-app.UseAuthorization();
+app.UseAuthMiddleware();
 
 app.MapControllerRoute(
     name: "default",

Properties/launchSettings.json

@@ -13,7 +13,7 @@
       "commandName": "Project",
       "dotnetRunMessages": true,
       "launchBrowser": true,
-      "applicationUrl": "https://localhost:7049;http://localhost:5133",
+      "applicationUrl": "https://localhost:7049",
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }

SecureDesignProject.csproj

@@ -8,7 +8,10 @@
     </PropertyGroup>
 
     <ItemGroup>
-      <Folder Include="Views\Auth\" />
+      <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
+      <PackageReference Include="Dapper" Version="2.1.35" />
+      <PackageReference Include="Konscious.Security.Cryptography.Argon2" Version="1.3.1" />
+      <PackageReference Include="System.Data.SqlClient" Version="4.8.6" />
     </ItemGroup>
 
 </Project>

Services/AuthService.cs

@@ -0,0 +1,102 @@
+using System.Security.Cryptography;
+using System.Text;
+using SecureDesignProject.Models;
+using Konscious.Security.Cryptography;
+
+namespace SecureDesignProject.Services;
+
+public class AuthService(DatabaseService dbService)
+{
+    public (bool success, byte[] sessionKey) AttemptLogin(LoginDetails loginDetails)
+    {
+        var account = dbService.GetAccountByEmail(loginDetails.Email);
+
+        if (account == null || VerifyHash(loginDetails.Password, account.HashedPassword, account.Salt))
+        {
+            return (false, []);
+        }
+
+        var newSession = dbService.InsertSession(new Session
+        {
+            SessionId = Guid.NewGuid(),
+            AccountId = account.AccountId,
+
+            SessionKey = RandomNumberGenerator.GetBytes(255),
+            IsValid = true,
+
+            Created = DateTime.Now,
+            LastSeen = DateTime.Now,
+            Expires = DateTime.Now.AddMinutes(10),
+        });
+
+        return (true, newSession.SessionKey);
+    }
+
+    public bool IsValidSession(byte[] key)
+    {
+        var session = dbService.GetSessionByKey(key);
+
+        return session != null;
+    }
+
+    public (bool success, byte[] SessionKey) AttemptCreateAccount(RegisterDetails registerDetails)
+    {
+        var existingAccount = dbService.GetAccountByEmail(registerDetails.Email);
+
+        if (existingAccount != null)
+        {
+            return (false, []);
+        }
+
+        var salt = GenerateSalt();
+        var account = dbService.InsertAccount(new Account
+        {
+            Email = registerDetails.Email,
+            HashedPassword = HashPassword(registerDetails.Password, salt),
+        });
+
+
+
+        var patient = dbService.InsertPatient(new Patient
+        {
+            FirstName = registerDetails.FirstName,
+            LastName = registerDetails.LastName,
+            AccountId = account.AccountId,
+            Address = null
+        });
+
+
+        //login new user
+        var (success, sessionKey) = AttemptLogin(new LoginDetails
+        {
+            Email = registerDetails.Email,
+            Password = registerDetails.Password
+        });
+
+        return (success, sessionKey);
+    }
+
+    private static byte[] HashPassword(string password, byte[] salt)
+    {
+        var argon2Id = new Argon2id(Encoding.UTF8.GetBytes(password));
+        argon2Id.Salt = salt;
+        argon2Id.Iterations = 4;
+        argon2Id.MemorySize = 64000;
+        argon2Id.DegreeOfParallelism = 1;   // num of threads
+
+        var hash = argon2Id.GetBytes(64);   // 64 byte hash
+
+        return hash;
+    }
+
+    private static byte[] GenerateSalt()
+    {
+        return RandomNumberGenerator.GetBytes(128);
+    }
+
+    private static bool VerifyHash(string password, byte[] hash, byte[] salt)
+    {
+        var newHash = HashPassword(password, salt);
+        return hash.SequenceEqual(newHash);
+    }
+}