GOC335 ExtensionMethods.cs

using System;
using System.Configuration;
using System.IO;
using System.Web.Security;

namespace Altairis.Nemesis.Events.WebCore.Security {
  public static class ExtensionMethods {

    public static string CreatePasswordResetCode(this MembershipUser user) {
      if (user == null) throw new ArgumentNullException("user");

      // Prepare data to compute hash from (username + date)
      byte[] data;
      using (var ms = new MemoryStream()) {
        using (var bw = new BinaryWriter(ms)) {
          bw.Write(user.UserName.ToLower());
          bw.Write(Math.Max(user.LastActivityDate.ToBinary(), user.LastLoginDate.ToBinary()));
        }
        data = ms.ToArray();
      }

      // Compute hash
      using (var hmac = new System.Security.Cryptography.HMACSHA1()) {
        hmac.Key = GetMacKey();
        var hash = hmac.ComputeHash(data);
        return hash.ToUrlSafeBase64String();
      }
    }

    public static bool VerifyPasswordResetCode(this MembershipUser user, string code) {
      if (user == null) throw new ArgumentNullException("user");
      if (code == null) throw new ArgumentNullException("code");

      return code.Equals(user.CreatePasswordResetCode(), StringComparison.Ordinal);
    }

    public static string CreateEmailChangeCode(this MembershipUser user, string newEmail) {
      if (user == null) throw new ArgumentNullException("user");
      if (newEmail == null) throw new ArgumentNullException("newEmail");
      if (string.IsNullOrWhiteSpace(newEmail)) throw new ArgumentException("Value cannot be empty or whitespace only string.", "newEmail");

      // Prepare data to compute hash from (username + old mail + new mail)
      byte[] data;
      using (var ms = new MemoryStream()) {
        using (var bw = new BinaryWriter(ms)) {
          bw.Write(user.UserName.ToLower());
          bw.Write(user.Email.ToLower());
          bw.Write(newEmail.ToLower());
        }
        data = ms.ToArray();
      }

      // Compute hash
      using (var hmac = new System.Security.Cryptography.HMACSHA1()) {
        hmac.Key = GetMacKey();
        var hash = hmac.ComputeHash(data);
        return hash.ToUrlSafeBase64String();
      }

    }

    public static bool VerifyEmailChangeCode(this MembershipUser user, string newEmail, string code) {
      if (user == null) throw new ArgumentNullException("user");
      if (newEmail == null) throw new ArgumentNullException("newEmail");
      if (string.IsNullOrWhiteSpace(newEmail)) throw new ArgumentException("Value cannot be empty or whitespace only string.", "newEmail");
      if (code == null) throw new ArgumentNullException("code");
      if (string.IsNullOrWhiteSpace(code)) throw new ArgumentException("Value cannot be empty or whitespace only string.", "code");

      return code.Equals(user.CreateEmailChangeCode(newEmail), StringComparison.Ordinal);
    }

    public static string ToUrlSafeBase64String(this byte[] data) {
      var s = Convert.ToBase64String(data);
      s = s.Replace('+', '-');
      s = s.Replace('/', '_');
      s = s.TrimEnd('=');
      return s;
    }

    // Private helper methods

    private static byte[] GetMacKey() {
      return Convert.FromBase64String(ConfigurationManager.AppSettings["PasswordResetKey"]);
    }

  }
}