Kebin Maharjan - 187 - Jan 25, 2015

ServiceStack Validation
1

Hi there,
I’m currently using facebook provider and running into a major issue where users can deny to share their email address(facebook permission screen). UserAuth gets created with Email address. Is there a way to make this a requirement? i.e UserAuth is not created if users don’t agree to give us the email address. 

For the users that are already in our system(without email), how would you suggest that next login will retrieve the email address?

Thanks!
Kebin

2

There is a custom validation filter you can use to add your own custom pre-auth validation, e.g: http://stackoverflow.com/a/25084436/85785

You should be able to just delete the Facebook entry from the UserAuthDetails table for that user which will run the validation logic the next time they sign-in.

3

Kebin Maharjan:

Perfect!
__________

4

Kebin Maharjan:

For the second part :
- deleting user auth details  to re-run the validation logic doesn’t work quite intended. Validation works but Facebook won’t ask/show login dialog to users again. User has no way to agree to share email unless they manually go to account settings etc. But looks like we can send auth_type: ‘rerequest’ for email?

 https://developers.facebook.com/docs/facebook-login/login-flow-for-web/v2.2#re-asking-declined-permissions

5

hmm not sure, looks like FB records the permission was denied for your App and doesn’t re-ask the user again. Not sure if this is possible within an OAuth call as the only configuration available is with requested scopes: 
https://github.com/ServiceStackApps/HttpBenchmarks/blob/master/src/BenchmarksAnalyzer/Web.config#L38

You might need to do this with FB’s JS API. 

6

Kebin Maharjan:

According to the FB’s doc below, adding a parameter auth_type=rerequest on an OAuth call will re-ask the user for the permissions that was denied.

https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/v2.2#reaskperms

7

The only way to change this was to subclass the AuthProvider and override the Authenticate() method to customize the urls used.

I’ve also just added url filters for each AuthProvider in this commit: 
https://github.com/ServiceStack/ServiceStack/commit/fce5a64620fa28a5bbdfca277855db82374e5dee

So you can provide a custom url filter to customize the different redirects urls used at registration with:

new FacebookAuthProvider {
    PreAuthUrlFilter = (authProvider, url) => url
}

Here you can return a diffrent url for ServiceStack to use instead.

8

Kebin Maharjan:

Awesome. Thanks a lot :slight_smile:

9

Kebin Maharjan:

So with this change, can we also remove or check to append ‘?’, if not already in the PreAuthUrlFilter for the query parameters? Otherwise we will have multiple '?'s on the url.

10

Can you link to a line number of what you mean? The whole url should be customizable in the filter.

11

Kebin Maharjan:

Nevermind, I was looking at PreAuthUrl instead of PreAuthUrlFilter. Thanks a lot!