While providing user login in encrypted username and password you need to make sure that the credentials entered will first be encrypted and then matched into the database entries for providing login.
ALTER PROC [dbo].[uspAuthenticateUser]
@Email NVARCHAR(100),
@Password NVARCHAR(50),
@DeviceUUID VARCHAR(500),
@DeviceType VARCHAR(150)
AS
IF EXISTS(SELECT 1 FROM [dbo].[User] WHERE [Email] = @Email AND [IsDeleted] = 0)
BEGIN
Declare @PasswordEncrypted NVARCHAR(MAX);
Declare @PasswordDecrypted VARCHAR(MAX);
Declare @PasswordSalt VARCHAR(50);
SELECT @PasswordEncrypted = [Password], @PasswordSalt = [PasswordSalt] FROM [dbo].[User] WHERE [Email] = @Email AND [IsDeleted] = 0
SET @PasswordDecrypted = CONVERT(VARCHAR(MAX), DECRYPTBYPASSPHRASE (@PasswordSalt, @PasswordEncrypted))
IF(@Password = @PasswordDecrypted)
BEGIN
UPDATE [dbo].[User]
SET [DeviceUUID] = @DeviceUUID,
[DeviceType] = @DeviceType
WHERE [Email] = @Email AND [IsDeleted] = 0
SELECT [Email], FirstName + ' ' + LastName As FullName, [AccessToken],id FROM [dbo].[User] WHERE [Email] = @Email AND [IsDeleted] = 0
END
END
In this stored procedure we have first encrypted the username and password using the password salt.
Then we will match it with the database entry based on its email.
If it is valid we will return access token of the user .
0 Comment(s)