Stored Procedure populating a Model in .net Core - html

Question

I have a project that has a login screen. When the user logs in the Controller calls another Class that I am using as a data Access class. This Class called the stored procedure to verify if the user is valid and pulls back all the user information and loads it into a UserModel. This works as I just have the data access method return a bool. So then I am logged in. But the information is not staying or is never stored in my model. I have been researching this and working off and on for this for weeks. I am hoping another set of eyes will help show me what I am missing. Thanks.
Here is my Model
public class UserModel
{
/// <summary>
/// Holds the current username.
/// </summary>
public string UserName {get;set;}
/// <summary>
/// Holds the First Name of the user.
/// </summary>
public string FirstName { get; set; }
/// <summary>
/// Holds the last name of the user.
/// </summary>
public string LastName { get; set; }
/// <summary>
/// Holds the users Date of Birth.
/// </summary>
public string UserDOB { get; set; }
/// <summary>
/// Holds the users Email Address
/// that was provided.
/// </summary>
public string Email { get; set; }
/// <summary>
/// Holds the current Password of the user.
/// </summary>
public string Password { get; set; }
/// <summary>
/// Holds the Date the account was created.
/// </summary>
public DateTime CreationDate { get; set; }
/// <summary>
/// Holds the PK of the type of user,
/// Admin, Standard, Promotional
/// </summary>
public int UserType { get; set; }
}
Here is my Data Access
public bool UserLogin(string userName, string Password)
{
bool userFound = false;
const string Query = #"GetUserLogin";
using (SqlConnection connection = new SqlConnection(connectionString))
{
connection.Open();
SqlCommand command = new SqlCommand(Query, connection)
{
CommandType = CommandType.StoredProcedure
};
command.Parameters.AddWithValue("#UserName", userName);
command.Parameters.AddWithValue("#Password", Password);
using (SqlDataReader reader = command.ExecuteReader())
{
reader.Read();
userModel.UserName = reader["UserName"].ToString();
userModel.FirstName = reader["FirstName"].ToString();
userModel.LastName = reader["LastName"].ToString();
userModel.Email = reader["Email"].ToString();
userModel.UserDOB = reader["UserDOB"].ToString();
if (reader == null)
{
userFound = false;
}
else
{
userFound = true;
}
}
}
return userFound;
}
This is my User Controller
public class UserController : Controller
{
private UserLoginDataAccess dataAccess = new UserLoginDataAccess();
// GET: /Login/
[HttpGet]
public IActionResult Login()
{
return View();
}
[HttpPost, ValidateAntiForgeryToken]
public IActionResult Login(UserModel model)
{
bool isLoggedIn;
isLoggedIn = dataAccess.UserLogin(model.UserName, model.Password);
if (isLoggedIn)
{
return View("Dashboard");
}
else
{
return View();
}
}
}

Answer 1

Firstly, this is never not null:
if (reader == null)
Secondly: where / how is userModel defined? If that is a field on the controller, then note that it jsn't persisted anywhere between requests. You need to use other approaches here. Usually an auth cookie of some kind.
Thirdly: I'm horrified to know whether you're doing a flat password compare in the DB; please let it be hashed...
Fourthly: writing your own security code is almost never a good idea. There are login providers that get it right. I recommend using them.
Fifthly: you should test whether Read() returned true or not - although frankly I think I'd recommend offloading all of this DB code to something like Dapper.