Re-authentication
-------

**Example:**
	
	using System;
	using System.Collections.Generic;
	using System.Linq;
	using System.Web;
	using System.Data.SqlClient;
	using System.ComponentModel.DataAnnotations;
	using System.Web.SessionState;

	namespace MvcApplication1.Controllers
	{
		public class reauth
		{
			//Getters and setters for our user method
			[Key]
			public int userID { get; set; }
			public string username { get; set; }
			public string password { get; set; }
			public string access { get; set; }
			public string salt { get; set; }
			public int privilege { get; set; }

			//First we include the audit log class.
			auditLogs Log = new auditLogs();

			//Seccond we include the password hash.
			hashing hash = new hashing();

			//Third we include the random password/token class.
			randomizer CSRF = new randomizer();

			//Add the logout class
			logout logoff = new logout();

			public bool reAuthentication()
			{
				//Here we connect to the database by means of a connection string as configured in the web.config
				SqlConnection conn = new SqlConnection
				(System.Configuration.ConfigurationManager.ConnectionStrings["users"].ConnectionString);

				bool loggedin = false;
				string passwordHash = "";

				conn.Open();

				//Here we select the user from the users tabele by the sessionID
				string query = string.Format("SELECT * from users WHERE userID = @userID ");
				SqlCommand cmd = new SqlCommand(query, conn);

				//We bind the parameter in order to prevent sql injections
				cmd.Parameters.AddWithValue("@userID", 1);

				//Next we read the value from the database and put it into a variable
				using (SqlDataReader oReader = cmd.ExecuteReader())
				{
					while (oReader.Read())
					{
						passwordHash = Convert.ToString(oReader["password"]);
						salt = Convert.ToString(oReader["salt"]);
					}
				}

				/*
				We validate the password see "Password storage(salting stretching hashing)" in the code examples
				for more detailed information:
				*/
				if (hash.Validate(passwordHash, salt, password) == true)
				{
					//the connection has to be repported into the log files
					Log.SetLog("Null", "login was OK!", "SUCCESS", "NULL");

					/*
					This is is to prevent session fixation, after login we create a new cookie which
					we than use to authenticate. This value can not be fixated since it is set after 
					login.
				 
					createa a new GUID and save into the session:
					*/

					//Al the random tokens will now be changed
					string guid = Guid.NewGuid().ToString();
					HttpContext.Current.Session["AuthToken"] = guid;

					// now create a new cookie with this guid value
					HttpContext.Current.Response.Cookies.Add(new HttpCookie("AuthToken", guid));

					/*
					Now we create a random value for our CSRF tokens. See "Random password/token generation" in
					the code examples for more detailed information:
					*/
					string CSRftoken = CSRF.generate(25);
					System.Web.HttpContext.Current.Session["CSRF"] = CSRftoken;

					HttpContext.Current.Session["Authenticated"] = "access";

					loggedin = true;
				}
				else
				{
					//If things went wrong we destroy the entire session. see "logout" code example for more info:
					logoff.logOut();
				}
				return loggedin;
			}
		}
	}

