Authentication implementation

WebApp/Program.cs

@@ -2,6 +2,7 @@ using Data;
 using Microsoft.EntityFrameworkCore;
 using MudBlazor.Services;
 using WebApp;
+using WebApp.Authentication;
 using WebApp.Components;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -24,7 +25,13 @@ builder.Services.AddDatabaseDeveloperPageExceptionFilter();
 builder.Services.AddScoped<ClipboardService>();
 
 builder.Services.AddScoped<StateContainer>(); // Server-side
-builder.Services.AddSingleton<StateContainer>();//Client-side 
+builder.Services.AddSingleton<StateContainer>();//Client-side
+
+// Add authentication services
+builder.Services.AddHttpContextAccessor();
+builder.Services.AddScoped<AuthenticationService>();
+builder.Services.AddSingleton<LoginRateLimitService>();
+builder.Services.AddHostedService<LoginRateLimitService>(sp => sp.GetRequiredService<LoginRateLimitService>()); 
 
 // Add authentication options
 builder.Services.AddAuthentication("Auth")
@@ -33,6 +40,12 @@ builder.Services.AddAuthentication("Auth")
         options.ExpireTimeSpan = TimeSpan.FromMinutes(20);
         options.SlidingExpiration = true;
         options.LoginPath = "/login";
+
+        // Enhanced security settings
+        options.Cookie.HttpOnly = true;
+        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
+        options.Cookie.SameSite = SameSiteMode.Strict;
+        options.Cookie.Name = "TSA.Auth";
     });
 builder.Services.AddCascadingAuthenticationState();
 
@@ -47,7 +60,7 @@ if (!app.Environment.IsDevelopment())
     app.UseMigrationsEndPoint();
 }
 
-//app.UseHttpsRedirection();
+app.UseHttpsRedirection();
 app.UseRouting();
 
 app.UseAuthentication();
@@ -62,4 +75,19 @@ app.MapRazorComponents<App>()
 // Used for AuthController
 app.MapControllerRoute("default", "{controller}/{action}");
 
+// Development-only password hash generator endpoint
+if (app.Environment.IsDevelopment())
+{
+    app.MapGet("/dev/hash-password", (string password) =>
+    {
+        var hash = PasswordHashGenerator.GenerateHash(password);
+        return Results.Ok(new
+        {
+            password,
+            hash,
+            message = "Copy the hash value to your User Secrets configuration"
+        });
+    }).WithName("GeneratePasswordHash");
+}
+
 app.Run();