Is this a POST request? GET’s for authentication should be disabled by default. Can you provide the full HTTP Request/Response headers (replace any sensitive info with xxxx) as well as your AuthFeature registration.
Also, I am loading my AppSettings this way (where I have my jwt.AuthKeyBase64):
var builder = new ConfigurationBuilder()
.SetBasePath(env.ContentRootPath)
.AddJsonFile("appsettings.Development.json")
.AddJsonFile("appsettings.json");
var config = builder.Build();
app.UseServiceStack(new AppHost
{
AppSettings = new MultiAppSettings(new EnvironmentVariableSettings(), new NetCoreAppSettings(config))
});
I’m not able to repro this, it’s always returning the bearerToken/refreshToken with every successful credentials auth on both http://localhost:5000 and https://localhost:5001:
This is the logic which determines when JWT Tokens are populated:
You should be able to find out what condition is preventing populating tokens with a Dummy Auth Provider with an IAuthResponseFilter that tests the same conditions as the JWT AuthProvider, e.g:
public class DummyAuthProvider : AuthProvider, IAuthResponseFilter
{
public DummyAuthProvider() => Provider = "dummy";
public void Execute(AuthFilterContext authContext)
{
var jwt = (JwtAuthProvider)AuthenticateService.GetJwtAuthProvider();
if (authContext.DidAuthenticate && jwt.SetBearerTokenOnAuthenticateResponse && authContext.Session.IsAuthenticated)
{
if (!jwt.RequireSecureConnection || authContext.AuthService.Request.IsSecureConnection)
{
//... will populate jwt tokens
}
}
//.. wont populate jwt tokens
}
public override bool IsAuthorized(IAuthSession session, IAuthTokens tokens, Authenticate request = null) =>
throw new NotImplementedException();
public override Task<object> AuthenticateAsync(IServiceBase authService, IAuthSession session, Authenticate request,
CancellationToken token = default) => throw new NotImplementedException();
public Task ResultFilterAsync(AuthResultContext authContext, CancellationToken token = default) => Task.CompletedTask;
}
What is the difference between these two?
If I use the way it was before (in Program.cs) it still works.
Is there any advantage on using the new approach (with UseKestrel())?
Then it’s due to the custom MultiAppSettings which returns the types default Type value instead of the default missing value. You should be able to override it with:
new JwtAuthProvider {
SetBearerTokenOnAuthenticateResponse = true
}
I’m assuming the difference was your custom MultiAppSettings change and not related to the library or framework upgrade.
The first is the default recommended ASP .NET Core WebHost builder with all default recommended options whilst the later is building its own host and not using the default options. Similar to the difference between web and selfhost project templates.
Thanks that worked with the BearerToken to be included in response so now I am able to send it on every new request.
But now when I try to post to an endpoint with [Authenticate] attribute, it rejects me with a 401.
Regarding Program.cs, I guess I assumed original project was scaffolded with selfhost, but it seems that it was a web template. So maybe I need to start all over again, by starting with web template instead to see if this solves the issue, unless you have any other thing on mind? I am not sure if there are other differences between web and selfhost templates…
With all integration issues you should inspect the raw HTTP Headers to see if Authentication token is actually being sent and if it is, what the specific Auth error is returned which may help identify where to look.
As for the setup, I’d stick with the defaults unless you have a reason not to use them.
Nothing stands out except that it’s a CORS request but Authorization is an allowed header so the browser allows sending the Authorization header. Did you try it without MultiAppSettings? i.e. with just:
app.UseServiceStack(new AppHost {
AppSettings = new NetCoreAppSettings(config),
});
In case it impacted any of the other default configuration values.
If you try again later & still have the issue, put together a small repro and I’ll take a look.
app.UseServiceStack(new AppHost
{
AppSettings = new MultiAppSettings(new NetCoreAppSettings(Configuration))
});
But this does work:
app.UseServiceStack(new AppHost
{
AppSettings = new NetCoreAppSettings(Configuration)
});
Notice that I am not using this anymore:
var builder = new ConfigurationBuilder()
.SetBasePath(env.ContentRootPath)
.AddJsonFile("appsettings.Development.json")
.AddJsonFile("appsettings.json");
var config = builder.Build();
Now the problem is how can I use MultiAppSettings as I still require reading from Environment Variables…
When using Token Cookies JWTs are only returned in HttpOnly, Secure Cookies which prevents XSS exploits from being able to capture and use JWT Auth Tokens to make authorized requests.
It’s also better for token management where clients don’t need to manually handle tokens when authorizing their HTTP/Service Client & allows the server to transparently refresh JWTs.
