Authenticate vs ValidateIsAuthenticated

ServiceStack Authentication
1

What is the difference between Authenticate and ValidateIsAuthenticated attributes and what is the recommended way of securing the services serving the Razor Views, while using the ASP.NET Identity?

Explanation:
I am trying to migrate the authentication from the ServiceStack.Auth to ASP.NET Core Identity. The docs are saying to use the validation api (ASP.NET Core Identity Auth).

So far, our pages (Razor Views) were protected with the Authenticate attribute, that redirected unauthenticated users to the login page (when the Request.IsHtml()). When switching to ValidateIsAuthenticated the response throws the 401 instead of redirecting.

Our page is defined like so:

    [Route(SiteMap.Dashboard)]
    [Route(SiteMap.Dashboard_DashboardId)]
    [ValidateIsAuthenticated]
    // [Authenticate]
    // [RequiredPermissionExt(Permission.CanViewDashboard, HtmlRedirect = "/forbidden")]
    [Restrict(RequestAttributes.Html)]
    [DefaultView("Dashboard")]
    public class DashboardRequest
    {
        public int? DashboardId { get; set; }
    }

    public class PageService {
        public object Get(DashboardRequest request) {
            return someModelForRazorViewCreatedHere();
        }
    }
2

Hi @ramen-pipul ,

Since AuthenticateAttribute is in the ServiceStack pacakage, it is generally used on service implementations rather than Request DTOs which are usually in a low dependency project like the .ServiceModel project that comes with the templates. Eg

[Authenticate]
public class MyServices : Service
{
    public object Any(Hello request)
    {
        return new HelloResponse { Result = $"Hello, {request.Name}!" };
    }
}

The ValidateIsAuthenticated attribute is in the ServiceStack.Interfaces library, so it can be more easily used on Request DTOs in the ServiceModel shared project, just as you have shown using it above, and uses SharpScript expressions to test different validation rules.

I’m not clear on what your RequiredPermissionExt is doing, but assuming that is inheriting from RequiredPermissionAttribute which is where your redirection is coming from.

Using the Authenticate attribute will likely make more sense when you are securing endpoints designed to be interacted with via a browser since you will get that handling of redirection but API only endpoints can use the lighter Validate range of attributes including ValidateIsAuthenticated, which will make your DTO easier to share. Both are handled with the ASP.NET Core Identity Auth integration showed in our templates.

Hope that helps.

1 Like
3

Hello @layoric,
thanks for the clarification! It was very helpful. I am assuming then, the Authenticate is not going anywhere and it’s safe to use for the pages and any static content.

The RequiredPermissionExt was actually a re-implementation of the ServiceStack’s RequiredPermission and it inherits directly from the Authenticate attribute. Only it applies some query params to the HtmlRedirect path, so once the permission is granted it will redirect the user to the page that was forbidden before.

1 Like