public ActionResult Login(LoginModel model)
{
if (ModelState.IsValid)
{
//Sanitize all input.
model.LoginName = model.LoginName.Sanitize(Utility.EmailWhiteList);
model.Password = model.Password.Sanitize(Utility.PasswordWhiteList);
//Gather the salt. this will be the ONLY instance of us hitting the
//Database more than once in one request
string salt = globalAccountRep.GetSaltByLoginName(model.LoginName);
model.Password = hashString(model.Password + salt);
//
AccountModel acct = globalAccountRep.Login(model);
if (acct.Success)
{
string userData = string.Join("|", "");
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
1, // ticket version
acct.AccountId + "," + acct.Username, // authenticated username
DateTime.Now, // issueDate
DateTime.Now.AddDays(180), // expiryDate
true, // true to persist across browser sessions
userData, // can be used to store additional user data
FormsAuthentication.FormsCookiePath); // the path for the cookie
// Encrypt the ticket using the machine key
string encryptedTicket = FormsAuthentication.Encrypt(ticket);
// Add the cookie to the request to save it
HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
cookie.HttpOnly = true;
Response.Cookies.Add(cookie);
}
return Json(new AccountViewModel(acct));
}
model.Success = false;
return Json(model);
}
//Successfully tested. runs fine
/// <summary>
/// Get login information and validates against database
/// </summary>
/// <param name="loginModel"></param>
/// <returns></returns>
public AccountModel Login(LoginModel loginModel)
{
SqlCommand command = new SqlCommand("AccountLogin", new SqlConnection(this.connectionString));
command.Parameters.AddWithValue("@LoginName", loginModel.LoginName);
command.Parameters.AddWithValue("@Password", loginModel.Password);
DataSet dsResult = DataTools.RunStoredProcedure(command);
AccountModel acct = new AccountModel();
try
{
acct = getAccountFromDataRow(dsResult.Tables[1].Rows[0]);
}
catch { }
//check for message and same for success
if (dsResult.Tables[0].Rows[0]["Message"] != null)
acct.Message = Convert.ToString(dsResult.Tables[0].Rows[0]["Message"]);
if (dsResult.Tables[0].Rows[0]["Success"] != null)
acct.Success = Convert.ToBoolean(dsResult.Tables[0].Rows[0]["Success"]);
return acct;
}