Getting Basic login prompt instead of redirect

Question

I have a .NET Core web application where I'm using ServiceStack. For authentication I'm using two auth providers; ApiKeyAuthProvider and CredentialsAuthProvider. I have specified a redirect URL when creating the AuthFeature. In the case of the credentials provider authentication is done through a SSO-portal using Windows Authentication. If a Windows auth user is logged out for some reason I want them to be redirected back to the SSO site.

When I'm no longer logged I have these two scenarios:

Scenario 1: I go to the application root in the browser and a request for /foo is automatically made using Axios resulting in a 401 response.

Scenario 1 Result: The browsers shows a Basic login prompt.

Scenario 2: I enter /foo in my address bar in the browser and navigate there.

Scenario 2 Result: The HtmlRedirect I entered when creating the AuthFeature kicks in and I get redirected back to the SSO-site.

What I want is the result i get in the second scenario for all requests resulting in a 401. Shouldn't this already be the case? And how can I make this happen?

user_4383615 · Answer

Solution

My colleague solved this by changing the order of our Auth Providers when initializing the AuthFeature in the AppHost.

Why did it work?

When our credentials auth provider was placed first instead of the api key provider the response did not have the Www-Authenticate: Basic header and the prompt was not triggered by the browser.

If none of the available auth providers return true the failed authentication is automatically handled by the first in the list.

https://github.com/ServiceStack/ServiceStack/blob/fb26d594dfaff97ff307244084fcc57ec78539f6/src/ServiceStack/AuthenticateAttribute.cs#L85

Getting Basic login prompt instead of redirect

1 Answers