BasicAuthProvider in ServiceStack
- by Per
I've got an issue with the BasicAuthProvider in ServiceStack. POST-ing to the CredentialsAuthProvider (/auth/credentials) is working fine.
The problem is that when GET-ing (in Chrome):
http://foo:pwd@localhost:81/tag/string/list
the following is the result
Handler for Request not found:
Request.HttpMethod: GET
Request.HttpMethod: GET
Request.PathInfo: /login
Request.QueryString: System.Collections.Specialized.NameValueCollection
Request.RawUrl: /login?redirect=http%3a%2f%2flocalhost%3a81%2ftag%2fstring%2flist
which tells me that it redirected me to /login instead of serving the /tag/... request.
Here's the entire code for my AppHost:
public class AppHost : AppHostHttpListenerBase, IMessageSubscriber
{
private ITagProvider myTagProvider;
private IMessageSender mySender;
private const string UserName = "foo";
private const string Password = "pwd";
public AppHost( TagConfig config, IMessageSender sender )
: base( "BM App Host", typeof( AppHost ).Assembly )
{
myTagProvider = new TagProvider( config );
mySender = sender;
}
public class CustomUserSession : AuthUserSession
{
public override void OnAuthenticated( IServiceBase authService, IAuthSession session, IOAuthTokens tokens, System.Collections.Generic.Dictionary<string, string> authInfo )
{
authService.RequestContext.Get<IHttpRequest>().SaveSession( session );
}
}
public override void Configure( Funq.Container container )
{
Plugins.Add( new MetadataFeature() );
container.Register<BeyondMeasure.WebAPI.Services.Tags.ITagProvider>( myTagProvider );
container.Register<IMessageSender>( mySender );
Plugins.Add( new AuthFeature( () => new CustomUserSession(),
new AuthProvider[] {
new CredentialsAuthProvider(), //HTML Form post of UserName/Password credentials
new BasicAuthProvider(), //Sign-in with Basic Auth
} ) );
container.Register<ICacheClient>( new MemoryCacheClient() );
var userRep = new InMemoryAuthRepository();
container.Register<IUserAuthRepository>( userRep );
string hash;
string salt;
new SaltedHash().GetHashAndSaltString( Password, out hash, out salt );
// Create test user
userRep.CreateUserAuth( new UserAuth
{
Id = 1,
DisplayName = "DisplayName",
Email = "[email protected]",
UserName = UserName,
FirstName = "FirstName",
LastName = "LastName",
PasswordHash = hash,
Salt = salt,
}, Password );
}
}
Could someone please tell me what I'm doing wrong with either the SS configuration or how I am calling the service, i.e. why does it not accept the supplied user/pwd?
Update1: Request/Response captured in Fiddler2when only BasicAuthProvider is used.
No Auth header sent in the request, but also no Auth header in the response.
GET /tag/string/AAA HTTP/1.1
Host: localhost:81
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,sv;q=0.6
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ss-pid=Hu2zuD/T8USgvC8FinMC9Q==; X-UAId=1; ss-id=1HTqSQI9IUqRAGxM8vKlPA==
HTTP/1.1 302 Found
Location: /login?redirect=http%3a%2f%2flocalhost%3a81%2ftag%2fstring%2fAAA
Server: Microsoft-HTTPAPI/2.0
X-Powered-By: ServiceStack/3,926 Win32NT/.NET
Date: Sat, 10 Nov 2012 22:41:51 GMT
Content-Length: 0
Update2 Request/Response with HtmlRedirect = null . SS now answers with the Auth header, which Chrome then issues a second request for and authentication succeeds
GET http://localhost:81/tag/string/Abc HTTP/1.1
Host: localhost:81
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,sv;q=0.6
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ss-pid=Hu2zuD/T8USgvC8FinMC9Q==; X-UAId=1; ss-id=1HTqSQI9IUqRAGxM8vKlPA==
HTTP/1.1 401 Unauthorized
Transfer-Encoding: chunked
Server: Microsoft-HTTPAPI/2.0
X-Powered-By: ServiceStack/3,926 Win32NT/.NET
WWW-Authenticate: basic realm="/auth/basic"
Date: Sat, 10 Nov 2012 22:49:19 GMT
0
GET http://localhost:81/tag/string/Abc HTTP/1.1
Host: localhost:81
Connection: keep-alive
Authorization: Basic Zm9vOnB3ZA==
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,sv;q=0.6
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ss-pid=Hu2zuD/T8USgvC8FinMC9Q==; X-UAId=1; ss-id=1HTqSQI9IUqRAGxM8vKlPA==
