CODEWITHSUNDEEP
c#asp.net-coremiddleware
Vitalii
Vitalii

Reputation: 11071

How are middlewares executed in ASP.NET Core

I'm adding Auth0 to simple project and trying to understand how middlewares work.

In my Startup.cs I have this code

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory, IOptions<AuthSettings> auth0Settings)
{
    loggerFactory.AddConsole(Configuration.GetSection("Logging"));
    loggerFactory.AddDebug();

    if (env.IsDevelopment())
    {
       app.UseDeveloperExceptionPage();
    }

    app.UseStaticFiles();

    // Add the cookie middleware
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AutomaticAuthenticate = true,
        AutomaticChallenge = true
    });

    // Add the OIDC middleware
    var options = new OpenIdConnectOptions("Auth0")
    {
        // here there are some configurations
        // .....................
    };

    options.Scope.Clear();
    options.Scope.Add("openid");
    options.Scope.Add("name");
    options.Scope.Add("email");
    options.Scope.Add("picture");

    app.UseOpenIdConnectAuthentication(options);

    app.UseMvc(routeBuilder =>
    {
       routeBuilder.MapRoute("Default", "{controller=Home}/{action=Index}");
    });
}

If I understand correctly the idea of middleware in ASP.NET Core in our example, if there is a cookie present and authentication can be done by it

 app.UseCookieAuthentication(new CookieAuthenticationOptions
 {
      AutomaticAuthenticate = true,
      AutomaticChallenge = true
 });

OpenId middleware will not be executed.

 app.UseOpenIdConnectAuthentication(options);

Could somebody explain me how does OpenId middleware knows that it should not be executed?

At the bottom we have 

app.UseMvc(routeBuilder =>
{
     routeBuilder.MapRoute("Default", "{controller=Home}/{action=Index}");
});

How does it knows that it should always be executed but in case where we request some static file we do not use mvc.

Upvotes: 2

Views: 1036

Answers (1)

juunas
juunas

Reputation: 58723

Every single middleware in the pipeline can choose to call the next middleware. The reason you get static files instead of it hitting an MVC controller is because the static file middleware finds the file requested, and chooses not to call the next middleware in the chain. It simply returns the file as a response.

AutomaticAuthenticate in authentication middleware always means "Inspect the incoming request. If you find something that interests you, create a ClaimsPrincipal from it." In this case cookie authentication automatically creates a principal for the signed-in user when their sign-in cookie is in the request, before passing the request to the next middleware.

The OpenId Connect middleware executes actually, but it doesn't do anything because it won't find anything interesting in the request even if it had AutomaticAuthenticate = true. It is looking for requests to its callback path, which by default is set as CallbackPath = new PathString("/signin-oidc"); in the constructor.

The two authentication middleware are setup like this so that the cookie middleware runs always, but OpenId Connect only redirects to the identity provider when requested (e.g. by returning a ChallengeResult from your MVC controller).

Upvotes: 5

Related Questions