How to authorize SignalR Core Hub method with JWT

Question

I am using JWT authentication in my ASP.NET Core 2.0 application with OpenIddict.

I am following idea in this thread and calling AuthorizeWithJWT method after SignalR handshake. But now, I do not know what should I set in AuthorizeWithJWT method so I can use [Authorize(Roles="Admin")] for example.

I tried with setting context user, but it is readonly:

public class BaseHub : Hub
{    
    public async Task AuthorizeWithJWT(string AccessToken)
    {
        //get user claims from AccesToken
        this.Context.User = user;  //error User is read only
    }
}

And using authorize attribute:

public class VarDesignImportHub : BaseHub
{
    [Authorize(Roles = "Admin")]
    public async Task Import(string ConnectionString)
    {
    }
}

Makla · Accepted Answer · 2017-10-25 08:14:37Z

7

I strongly encourage you to continue doing authentication at the handshake level instead of going with a custom and non-standard solution you'd implement at the SignalR level.

Assuming you're using the validation handler, you can force it to retrieve the access token from the query string:

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication()
        .AddOAuthValidation(options =>
        {
            options.Events.OnRetrieveToken = context =>
            {
                context.Token = context.Request.Query["access_token"];

                return Task.CompletedTask;
            };
        });
}

Or OnMessageReceived if you want to use JWTBearer:

services.AddAuthentication()
    .AddJwtBearer(o =>
    {
        o.Events = new JwtBearerEvents()
        {
            OnMessageReceived = context =>
            {
                if (context.Request.Path.ToString().StartsWith("/HUB/"))
                    context.Token = context.Request.Query["access_token"];
                return Task.CompletedTask;
            },
        };
    });

No other change should be required.

edited Oct 25, 2017 at 8:14

Makla

10.6k19 gold badges81 silver badges156 bronze badges

answered Oct 18, 2017 at 14:32

Kévin Chalet

42.3k8 gold badges130 silver badges143 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Makla Over a year ago

Yes this would be a valid case, but as explain in github thread (link1, link2) there are some security risks with this approach. Because access_token in query is public (you can log it...). Will do that, if no other approach is possible.

Makla Over a year ago

But one time access token could do it? @Pinpoint What do you think?

Kévin Chalet Over a year ago

The only "risk" is that the access token will be included in the logs (which is clearly explained in the OAuth2 bearer specification). To avoid that, you could disable the logging traces including the query string using the filtering API.

Collectives™ on Stack Overflow

How to authorize SignalR Core Hub method with JWT

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related