Authentication in an ASP.NET MVC Application via token in an external widget (iframe)

user_5477376 0
Viewed 378

I have an ASP.NET MVC application (framework 4.7.2) with OWIN authentication enabled. This application is a monolitic ERP and works OK. This application have one resource that give a html report to users. One legacy Java application now need to have access to this resource. We develop a widget (javascript + iframe) to embeeded this resource in this legacy application. The widget use a token to have access to MVC application. These two applications are in diferente domains.

The widget works well when the two applications are in the same domain, but not in different domains. After the AuthenticationManager.SignIn(), the authentication not works and the user is redirected to login page. If I try login via "login page", this not works too, for being in a different domain and within the iframe.

I tried implement this, but it didn't solve: https://docs.microsoft.com/pt-br/aspnet/samesite/system-web-samesite.

Here is the code I used to authenticate by token:

[AllowAnonymous]
public async Task<ActionResult> LoginByToken(string token, string returnUrl)
{
   var user = GetUserByToken(token);
   if (user != null)
   {
      await SignInAsync(user);
      return RedirectToLocal(returnUrl);
   }
   else
      throw new Exception("The user was not authenticated!")
}

How can I make it works? Thanks for any help!

Note: the problem reported below occur in Chrome and Edge, but not in Firefox.

owin iframe cross-domain authentication asp.net-mvc
1 Answers

PROBLEM RESOLVED!!!

I found the answer here: https://docs.microsoft.com/pt-br/aspnet/samesite/csmvc

The configuration in the web.config not worked in my case. I needed to change the CookieAuthentication in the partial class Startup (/App_Start/Startup.Auth.cs), in the method ConfigureAuth like this:

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
   //---------------------------------
   // It resolve the problem
   CookieSameSite = SameSiteMode.None,
   CookieHttpOnly = true,
   CookieSecure = CookieSecureOption.Always,
   //---------------------------------
  
   AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
   LoginPath = new PathString("/Account/Login"),
   Provider = new CookieAuthenticationProvider
   {
      OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
          validateInterval: TimeSpan.FromMinutes(30),
          regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
   }
});

Note: the "src" in the iframe needed to be published in https.

user_54773760
Related