I have limited experience with both making REST APIs and implementing security features, so I figured it'd be worth running this code through some other people's eyes before making it live.
My main questions are around the use of REST - e.g. are there better ways to implement my methods that return bool
s?
(Assume the "drivers" are keyed in the DB by Name)
public class Driver
{
public string Name { get; set; }
public string Pass { get; set; }
}
[HttpPost]
[RequireHttps]
[ActionName( "GetPasswordExists" )]
public HttpResponseMessage GetPasswordExists([FromBody] Driver driver)
{
HttpResponseMessage response;
try
{
bool passExists = false;
// db operations
response = Request.CreateResponse(HttpStatusCode.OK, passExists);
}
catch (Exception)
{
response = Request.CreateResponse(HttpStatusCode.BadRequest);
}
return response;
}
[HttpPost]
[RequireHttps]
[ActionName("SetPassword")]
public HttpResponseMessage SetPassword([FromBody] Driver driver)
{
HttpResponseMessage response;
try
{
string hash = System.Web.Helpers.Crypto.HashPassword(driver.Pass);
// db operations
response = Request.CreateResponse(HttpStatusCode.OK);
}
catch (Exception)
{
response = Request.CreateResponse(HttpStatusCode.BadRequest);
}
return response;
}
[HttpPost]
[RequireHttps]
[ActionName("VerifyPassword")]
public HttpResponseMessage VerifyPassword([FromBody] Driver driver)
{
HttpResponseMessage response;
try
{
bool valid = false;
string hash = null;
// db operations
valid = System.Web.Helpers.Crypto.VerifyHashedPassword(hash, driver.Pass);
response = Request.CreateResponse(HttpStatusCode.OK, valid);
}
catch (Exception)
{
response = Request.CreateResponse(HttpStatusCode.BadRequest);
}
return response;
}
System.Web.Helpers.Crypto
) appears to be the recommended one by others on SO who also use C# to encrypt passwords. If anyone else who is more familiar with C# wants to point out that this is not the case, or suggest an alternative, I'm all ears! \$\endgroup\$ – pinkie Dec 11 '18 at 1:55