User session removed on failed login

ServiceStack Authentication
1

Hello,
with the standard credential validation there is the possibility to avoid the current session removing when a failed login occours?

The current behavior is this:

  1. User A login successfully
  2. User A session created
  3. User B try to login with wrong credentials.
  4. User A session removed

The desidered behavior is to keep the User A session also if a failed login occours.

Thank you.

2

You can prevent it from generating new session cookies on Authentication with:

Plugins.Add(new AuthFeature(...) {
    GenerateNewSessionCookiesOnAuthentication = false
});
1 Like
3

It works but only if the user i the same. Can I have the same behavior also if i try to login with a different username?

4

You could try overriding ResetSessionBeforeLoginAsync() in a custom CredentialsAuthProvider and not remove the session:

Although there are a number of places where sessions are removed, so it may not prevent the default behavior.

5

I tried, but the session have been removed before calling the method ResetSessionBeforeLoginAsync

6

Yeah RemoveSessionAsync is called a number of times after an invalid attempt, e.g. in AuthProvider.cs.

Not really an easier way to workaround it other than using local modified copies of AuthProvider and CredentialsAuthProvider and removing the times that it’s called.

7

I resolved usign both your suggestions. Below the implementation.

Thank you

Plugins.Add(new AuthFeature(...) {
    GenerateNewSessionCookiesOnAuthentication = false
});

protected override async Task<IAuthSession> ResetSessionBeforeLoginAsync(IServiceBase authService, IAuthSession session, string userName, CancellationToken token = default)
{
    if (!LoginMatchesSession(session, userName))
    {
        //await authService.RemoveSessionAsync(token).ConfigAwait();
        return await authService.GetSessionAsync(token: token).ConfigAwait();
    }
    return session;
}
1 Like