1

I am using Basic Authentication and I have created a Middleware for this. When I use the Authorize attribute and try to make an API call through Postman, i get 401 Unauthorize even as I am added the authorization details in Postman.

I am not sure if it is the way i am calling the controller action via postman or whether I am missing a header option in postman.

ConfigureServices

        services
            .AddAuthentication(BasicAuthenticationDefaults.AuthenticationScheme)
            .AddBasicAuthentication(GetBasicAuthenticationOptions(users));

Configure

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }

        app.UseMvc();
        app.UseCors("SiteCorsPolicy");
        app.UseAuthentication();
    }

Basic Authentication Implementation

    private Action<BasicAuthenticationOptions> GetBasicAuthenticationOptions(IList<UserConfiguration> users)
    {
        return options =>
        {
            options.Realm = "Public API";
            options.Events = new BasicAuthenticationEvents
            {
                OnValidatePrincipal = context =>
                {
                    var authenticatedUser = users.FirstOrDefault(u =>
                        u.Username == context.UserName && u.Password == context.Password);

                    if (authenticatedUser != null)
                    {
                        var claims = new List<Claim>
                        {
                            new Claim(ClaimTypes.Name,
                                context.UserName,
                                context.Options.ClaimsIssuer)
                        };

                        var principal = new ClaimsPrincipal(new ClaimsIdentity(claims,
                            BasicAuthenticationDefaults.AuthenticationScheme));
                        context.Principal = principal;

                        return Task.CompletedTask;
                    }

                    return Task.FromResult(AuthenticateResult.Fail("Authentication failed."));
                }
            };
        };
    }

Controller Action with Authorize

    [Authorize]
    [HttpPost]
    [Route("test")]
    public IActionResult Test()
    {
        return Json("yes");
    }

Postman request

The username and passwords are in the appsettings.json file

enter image description here

10
  • 1
    @KirkLarkin the services.AddAuthentication is the middleware code, and in the Configure method in the Startup.cs, there is a UseAuthentication in there
    – floormind
    May 23, 2018 at 11:37
  • 4
    Don't do that! You are storing and comparing unhashed passwords! Use ASP.NET Core's own mechanisms instead. This code almost guarantees you or your customer's site will be breached May 23, 2018 at 11:37
  • 3
    Although it's not related to the question you're asking, you will find that a lot of SO users will not want to help you write such insecure code. May 23, 2018 at 11:42
  • 2
    @ifelabolz Kirk Larkin already answered that in a roundabout way. Don't create your own. Use a provider like idunno.Authentication. The author is on .NET's security team, and he does say "You really shouldn't do this". This way you'll avoid problems in the middleware itself and only have to contend with secure password storage and validation. May 23, 2018 at 11:44
  • 2
    @ifelabolz if you don't provide all the code or don't mention the package you use, it's impossible to try and reproduce. In any case, did you try debugging ? What does this code do, how does it behave? Are you saying that package has a bug? Were you able to run the Test project in that repo? May 23, 2018 at 11:58

1 Answer 1

4

The issue was just because app.UseMvc(); was placed before app.UseAuthentication(); . I just had to place app.UseMvc(); after app.UseAuthentication(); and that fixed it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.