How can I make my Javascript not pop up every time a user gets directed to the a View/Page

Viewed 42

Currently I have a login page where if the user enters an invalid username or password and clicks "Login", a pop up message will display and say "Invalid username or password". This is fine, but the issue I'm facing now is that when I'm coming back to the Login page after a User signs up, or if the client is being redirected to the Login page, the same pop up message will display saying "Invalid username or password".

How can I make my code such that I avoid this issue? When a user signs up and goes back to the login page, the "Invalid username or password" alert should not appear.

Here are my codes: HTML/View

@{ 
    string loginError = (string) ViewData["loginError"];
}

@if (loginError != null)
{
<script type="text/javascript">
var message = '@loginError';
if(message)
    alert(message);
</script>
}


<form class="login-form" action="/Login/Login" method="POST">

    <div class="login-form__content">

        <div class="login-form__header">Login to your account</div>

        <input class="login-form__input" type="text" name="username" placeholder="Username">

        <input class="login-form__input" type="password" name="password" placeholder="Password">

        <button class="login-form__button" type="submit">Login</button>

        <p></p>

        <button class="login-form__button" type="submit" formaction="/Register/Index" id="signupbutton">Sign up</button>

    </div>

</form>

Controller:

public IActionResult Index()
        {
            if (Request.Cookies["SessionId"] != null)
            {
                string sessionId = Request.Cookies["sessionId"];
                Session session = dbContext.Sessions.FirstOrDefault(x =>
                    x.Id == sessionId)
                ;

                if (session == null)
                {
                    return RedirectToAction("Index", "Logout");
                }
                
                return RedirectToAction("Index", "Gallery");
            }

            string errorMessage = (string)TempData["loginError"];
            if (errorMessage != null)
            {
                ViewData["loginError"] = errorMessage;
            }

            return View();
        }

        public IActionResult Login(IFormCollection form)
        {
            string username = form["username"];
            string password = form["password"];

            HashAlgorithm sha = SHA256.Create();
            byte[] hash = sha.ComputeHash(Encoding.UTF8.GetBytes(username + password));

            User user = dbContext.Users.FirstOrDefault(x =>
               x.Username == username && x.PassHash == hash);

            if (user == null)
            {
                TempData["loginError"] = "Invalid username or password";
                return RedirectToAction("Index", "Login");
            }

            Session session = new Session()
            {
                User = user
            };
            dbContext.Sessions.Add(session);
            dbContext.SaveChanges();

            Response.Cookies.Append("SessionId", session.Id.ToString());
            Response.Cookies.Append("Username", user.Username);

            return RedirectToAction("Index", "Gallery");
        }
1 Answers

Change the following block:

if (user == null)
{
     TempData["loginError"] = "Invalid username or password";
     return RedirectToAction("Index", "Login");
}

With this:

if (user == null &&
    (!string.IsNullOrEmpty(username) && !string.IsNullOrEmpty(password)))
    {
        TempData["loginError"] = "Invalid username or password";
        return RedirectToAction("Index", "Login");
    }

The above code will ignore login requests which are completely empty. You should not even validating if the user name field is not inputted. To validate an user account, the user must input one of the fields (username or password).

Related