No session if service doesn't require Authentication

Andre · October 10, 2015, 1:12pm

I have a service method that doesn’t require authentication. For example “create post” that would create a post from the name “anonymous”. If an existing user calls “create post” I would like the post to have the name of the user.

My current implementaion have no Authenticate attribute on the method since its not required. But when a user with credentials calls this method (basic auth headers set and always send basicauth headers = true). Then no authentication is made and no session is created and my user still becomes “anonymous”.

Is there a way to make servicestack always authenticate if basicauth headers are provided so that my session gets created?

mythz · October 10, 2015, 1:30pm

The [Authenticate] option is what triggers the auto-login “IAuthWithRequest” behavior. Without the attribute there’s no logic in the request pipeline to pre-authenticate HTTP Basic Auth Requests.

So you should be able to run the logic in PreAuthenticate() in a Global Filter to get the desired behavior:

github.com

ServiceStack/ServiceStack/blob/master/src/ServiceStack/Auth/BasicAuthProvider.cs#L34


    var basicAuth = httpReq.GetBasicAuthUserAndPassword();
    if (basicAuth == null)
        throw HttpError.Unauthorized(ErrorMessages.InvalidBasicAuthCredentials.Localize(authService.Request));


    var userName = basicAuth.Value.Key;
    var password = basicAuth.Value.Value;


    return Authenticate(authService, session, userName, password, request.Continue);
}


public void PreAuthenticate(IRequest req, IResponse res)
{
    //API Keys are sent in Basic Auth Username and Password is Empty
    var userPass = req.GetBasicAuthUserAndPassword();
    if (!string.IsNullOrEmpty(userPass?.Value))
    {
        //Need to run SessionFeature filter since its not executed before this attribute (Priority -100)			
        SessionFeature.AddSessionIdToRequestFilter(req, res, null); //Required to get req.GetSessionId()


        using (var authService = HostContext.ResolveService<AuthenticateService>(req))
        {

You could just copy the logic or you re-use the existing logic in the BasicAuthProvider:

var auth = (IAuthWithRequest)AuthenticateService.GetAuthProvider(BasicAuthProvider.Name);
auth.PreAuthenticate(req,res);

Andre · October 12, 2015, 7:28pm

Thanks, using a global filter seems to work.

stefandv · May 11, 2018, 11:21am

Is this still the only option to have a Session when an authenticated user calls a service without the [Authorize] attribute?
If so, wouldn’t it be an idea to have a special attribute for these cases? As I understand it correctly, executing the PreAuthenticate logic in the Global Filter, will execute it twice in case of a secured service?

mythz · May 11, 2018, 2:29pm

PreAuthenticate() is automatically called when a session is retrieved so this is no longer needed, also a flag is added to prevent duplicate executions.

stefandv · May 11, 2018, 2:32pm

But still the issue is there for services without an [Authenticate] attribute that they won’t populate Session if this service is called authenticated.