Umbraco Web API - Cookie Authentication

Question

I'm using Umbraco 7.5 with an OWIN startup class.

Despite the shortcomings with using cookie auth, I'm trying to share the cookie auth between both MVC and Web API.

I have this in my OWIN startup class:

private static void ConfigureAuth(IAppBuilder app)
{
    app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

    CookieSecureOption secureCookieOption = CookieSecureOption.SameAsRequest;
#if DEBUG
    secureCookieOption = CookieSecureOption.Never;
#endif

    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
        AuthenticationMode = AuthenticationMode.Active,
        LoginPath = new PathString("/Account/Login"),
        CookieSecure = secureCookieOption,
        CookieManager = new ChunkingCookieManager(),
        Provider = new CookieAuthenticationProvider()
        }, PipelineStage.Authenticate);

    //configure B2C OAuth middleware
    foreach (string policy in AppSettings.B2CPolicies)
    {
        app.UseOpenIdConnectAuthentication(CreateBearerOptionsFromPolicy(policy));
    }

    // Use a cookie to temporarily store information about a user logging in with a third party login provider
    app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
}

This works fine as far as the Umbraco & custom MVC pages are concerned - the current user identity is available and the Umbraco helper methods work as expected.

However for Web API controllers - whether derived from UmbracoApiController or just ApiController, the current user identity on the HTTP Context is always null. I have checked the browser request being sent for to the API controllers, and the ASPNET identity cookie is included, so I'm confused as to why this doesn't translate to a user identity on the thread & httpcontext. Anyone able to shed some light on that?

Edit: some more info on this- I tried creating my own custom cookie authentication middleware and replaced the standard MS CookieAuthenticationHandler with my custom implementation so that I could trace the calls through it. Interestingly, for a normal MVC page, the AuthenticateCoreAsync method is invoked as the page loads, which successfully reads the cookie and returns a valid authentication ticket. For the Web API call, the AuthenticateCoreAsync method is not invoked at all before the API method is hit.

Community · Accepted Answer · 2017-05-23 12:17:26Z

0

I found the answer to this - it was nothing to do with OWIN, and everything to do with my Web API initialization code. I was mixing the code required for self-hosting Web API with the code required to get Web API running as part of the MVC app. Instead of IAppBuilder.UseWebApi() I should have been using GlobalConfiguration.Configure()

So the working code looks something like this:

public static void Configure(IAppBuilder app)
{
    GlobalConfiguration.Configure(Register);
}

private static void Register(HttpConfiguration config)
{
    ConfigureHttpRoutes(config);

    ConfigureFormatters(config);

    //etc...
}

A similar issue was encountered in this SO question.

edited May 23, 2017 at 12:17

CommunityBot

11 silver badge

answered Mar 28, 2017 at 14:38

booler

7051 gold badge7 silver badges16 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Umbraco Web API - Cookie Authentication

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related