public User Authenticate(string username, string password) { if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password)) { return(null); } var user = _context.Users.SingleOrDefault(x => x.Username == username); // check if username exists if (user == null) { return(null); } // check if password is correct if (!PasswordManagement.VerifyPasswordHash(password, user.PasswordHash, user.PasswordSalt)) { return(null); } // authentication successful return(user); }