Force Redirect to Another Page when First Time Login in ASP.NET Core

Question

currently I'm building web apps for local. When I create new user, I'm setup the user with Default Password. And I want to, if the User login with the Default Password it will redirect to Change Password Page. And User will not be able to access any page until they change the password.

My current workaround is checking in each controller, is there any Smart way to do this?

Here's some code after doing login

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Login([FromForm] LoginViewModel vm, string returnUrl = null)
{
    if (ModelState.IsValid)
    {
        var result = await repository.Login(vm);
        if (result.IsSuccess)
        {
            await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, result.Data,
                new AuthenticationProperties
                {
                    IssuedUtc = DateTime.UtcNow,
                    ExpiresUtc = DateTime.UtcNow.AddDays(1),
                    IsPersistent = false
                });

            if (vm.Password != Password.DefaultPassword)
            {
                return RedirectToLocal(returnUrl);
            }
            else
            {
                return RedirectToAction(nameof(UserController.NewPassword));
            }
        }
        else
        {
            ViewBag.ErrorMessage = result.ErrorMessage;
        }
    }

    return View(vm);
}

For the other Controller, we always check the Password from session. If the Password is same as Default Password we redirect it to NewPassword Page

Thanks in advance!

Answer 1

You can store user password using session as below

HttpContext.Session.SetString("Password", vm.password);

Then create a filter to check if the user login with the Default Password or not

public class PasswordFilter: IAuthorizationFilter
    {
        private readonly IHttpContextAccessor _httpContextAccessor;
        private readonly ISession _session;
        public PasswordFilter(IHttpContextAccessor httpContextAccessor)
        {
            _httpContextAccessor = httpContextAccessor;
            _session = _httpContextAccessor.HttpContext.Session;
        }

        public void OnAuthorization(AuthorizationFilterContext context)
        {

            if (_session.GetString("Password") == Password.DefaultPassword)
            {
                context.Result = new RedirectResult(nameof(UserController.NewPassword));

            }
        }
    }

Finally, you can use this filter by adding this attribute to your controllers

[TypeFilter(typeof(PasswordFilter))]

I hope this approach achieves your goal.

Answer 2

As @JHBonarius said, my current workaround now is to use Custom Middleware for Redirecting to New Password Page.

My middleware look like this:

public class CheckPasswordMiddleware
{
    private readonly RequestDelegate next;

    public CheckPasswordMiddleware(RequestDelegate next)
    {
        this.next = next;
    }

    public async Task Invoke(HttpContext context)
    {
        if (context.Request.Path != "/User/NewPassword" && context.User.Identity.IsAuthenticated)
        {
            var userId = context.User.Identity.GetUserId();
            if (!string.IsNullOrEmpty(userId))
            {
                var dbContext = context.RequestServices.GetRequiredService<DatabaseContext>();
                var passwordHash = await dbContext.User.Where(x => x.Id.ToLower() == userId.ToLower()).Select(x => x.Password).FirstOrDefaultAsync();
                if (Hash.Verify(Password.DefaultPassword, passwordHash))
                {
                    context.Response.Redirect("/User/NewPassword");
                }
            }
        }

        await next(context);
    }
}

and now I can get rid the check in my other controller, and my Login will just look like this:

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Login([FromForm] LoginViewModel vm, string returnUrl = null)
{
    if (ModelState.IsValid)
    {
        var result = await repository.Login(vm);
        if (result.IsSuccess)
        {
            await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, result.Data,
                new AuthenticationProperties
                {
                    IssuedUtc = DateTime.UtcNow,
                    ExpiresUtc = DateTime.UtcNow.AddDays(1),
                    IsPersistent = false
                });
            return RedirectToLocal(returnUrl);
        }
        else
        {
            ViewBag.ErrorMessage = result.ErrorMessage;
        }
    }

    return View(vm);
}

Hope this help anyone who want to achieve the same goals.

Thanks!