CODEWITHSUNDEEP
c#authenticationowinnancy
Bart de Ruijter
Bart de Ruijter

Reputation: 952

Stateless authentication with NancyFx, OWIN and JWT

I have a OWIN self-hosted application which has a front-end where users can sign up. Nancyfx does the logic for routing and Models, and in the documentation I saw that Nancyfx comes with 3 types of authentication.

I've settled on the Stateless Authentication, and following this example I tried to set up a basic form of authentication.

I wanted to expand further on this, using JWT to have some basic info handy and as a form of basic authentication (e.g. client has token so he's verified.), but this is where I run into a few problems.

  1. The way I authenticate Home -> login -> redirect upon success causes my Response.Header.Authorization to be cleared, not allowing me to catch the token in my custom Bootstrapper.

Code:

protected override void RequestStartup(TinyIoCContainer requestContainer, IPipelines pipelines, NancyContext context)
{
   AllowAccessToConsumingSite(pipelines);
   StatelessAuthentication.Enable(pipelines, requestContainer.Resolve<IStatelessAuthConfigurationFactory>().Config());
}

//Returns ClaimsPrincipal or Null;
public StatelessAuthenticationConfiguration Config()
{
    if(_stat == null)
    {
        _stat = new StatelessAuthenticationConfiguration(VerifyToken);
    }
    return _stat;
}

  1. Since my authorization header disappears every request, I would need to persist the JWT. I figure it's possible using OWIN environment or Nancy context, but would this be advisable + what would the effect be for a multi-user environment regarding security.

  2. OWIN has it's own authentication Manager that I could use, I've experimented with it, but it tends to provide a cookie upon successful sign in, which it doesn't seem to revoke on Logout. I just ran into a few issues overall with it, so I settled on NancyFx authentication. (not really a problem as a more general remark I suppose)

Thanks in advance for any help!

Upvotes: 1

Views: 1664

Answers (1)

circular
circular

Reputation: 103

Regarding (1), if you roll your own redirection after a successful login, consider setting the Authorization header during the redirect, e.g.

return Response.AsRedirect("/").WithHeader("Authorization", token);

It's actually the responsibility of the client to hold the valid JWT token after authentication. Returning it as a cookie (and deleting it upon logout) could make things easier in terms of client-side implementation and avoid the token persistence issue.

Regarding (2), not really, it's not necessary. JWT tokens are self-contained, and that's why they're useful in stateless auth scenarios.

Upvotes: 1

Related Questions