Issue with SSE and "Access to Subscription 'XYZ' is forbidden"

mythz · July 2, 2019, 8:25am

This is the Exception being thrown:

ServiceStack/ServiceStack/blob/35facd3826f331ddbd7684c441fc389814f0fe69/src/ServiceStack/ServerEventsFeature.cs#L370




    public object Any(UpdateEventSubscriber request)
    {
        var subscription = ServerEvents.GetSubscriptionInfo(request.Id);


        if (subscription == null)
            throw HttpError.NotFound(ErrorMessages.SubscriptionNotExistsFmt.Fmt(request.Id.SafeInput()));


        var feature = HostContext.GetPlugin<ServerEventsFeature>();
        if (!feature.CanAccessSubscription(base.Request, subscription))
            throw HttpError.Forbidden(ErrorMessages.SubscriptionForbiddenFmt.Fmt(request.Id.SafeInput()));


        if (request.UnsubscribeChannels != null)
            ServerEvents.UnsubscribeFromChannels(subscription.SubscriptionId, request.UnsubscribeChannels);
        if (request.SubscribeChannels != null)
            ServerEvents.SubscribeToChannels(subscription.SubscriptionId, request.SubscribeChannels);


        return new UpdateEventSubscriberResponse();
    }
}

Which occurs when a different User Address tries to update its subscription which is different to the original request which created the subscription:

github.com

ServiceStack/ServiceStack/blob/35facd3826f331ddbd7684c441fc389814f0fe69/src/ServiceStack/ServerEventsFeature.cs#L103-L109


internal bool CanAccessSubscription(IRequest req, SubscriptionInfo sub)
{
    if (!ValidateUserAddress)
        return true;


    return sub.UserAddress == null || sub.UserAddress == req.UserHostAddress;
}

You can use a Request Filter to compare against the current and original User Address.

This validation check can also be disabled with:

Plugins.Add(new ServerEventsFeature {
    ValidateUserAddress = false,
});