.NET - Is there a way to validate the httponly token and header token?

Question

I have an ASP.NET Core 8.0 Web API that is configured to authenticate with http-only JWT token.

This is my code to create the authentication and authorization:

builder.Services.AddAuthorizationBuilder()
    .AddPolicy("Bearer", new AuthorizationPolicyBuilder()
    .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme‌)
    .RequireAuthenticatedUser().Build());

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddCookie(opt =>
    {
        opt.Cookie.Name = Token.TokenKey;
    })
    .AddJwtBearer(opt =>
    {
        opt.RequireHttpsMetadata = false;
        opt.SaveToken = true;
        opt.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes("myKey")),
            ValidateIssuer = false,
            ValidateAudience = false
        };
        opt.Events = new JwtBearerEvents
        {
            OnMessageReceived = ctx =>
            {
                ctx.Token = ctx.Request.Cookies[Token.TokenKey];
                return Task.CompletedTask;
            }
        };
    });

My scenario: I want to work with two tokens. One sent by the header and one managed by the server using http-only cookies. My goal with this approach is increase the security of my API, so that requests only become valid if both tokens are valid.

My problem: currently the API only returns the 401 Unauthorized error if I am not authenticated using the http-only cookie, but if I am authenticated on the server side (with the http-only cookie), the request reaches the API, even without sending the header token.

My question: I want the API to only be reached if the user is authenticated by the server with the http-only cookie and another valid token is sent through the header. Is there any way to do this?

Fengzhi Zhou · Accepted Answer · 2024-04-09 08:35:38Z

You could use custom middleware to implement header token validation. The logic is to add one more token auth after server authenticated.

1.Define your middleware

public class ValidateHeaderTokenMiddleware
{
    private readonly RequestDelegate _next;

    public ValidateHeaderTokenMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task Invoke(HttpContext context)
    {
        if (context.User.Identity.IsAuthenticated)
        {
            var headerToken = context.Request.Headers["Authorization"].FirstOrDefault()?.Split(" ").Last();

            // Custom vaidation logic
            if (!IsValidToken(headerToken))
            {
                context.Response.StatusCode = 401; // Unauthorized
                await context.Response.WriteAsync("Invalid header token.");
                return;
            }
        }

        await _next(context);
    }

    private bool IsValidToken(string token)
    {
        // Custom vaidation logic
        return true;
    }
}

2.Register the service in program

app.UseAuthentication();
app.UseMiddleware<ValidateHeaderTokenMiddleware>();
app.UseAuthorization();

Server authenticated and token validated , endpoint hit.

Collectives™ on Stack Overflow

.NET - Is there a way to validate the httponly token and header token?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related