How should I send additional authorization id?

user_9487421 0
Viewed 76

I've got a case where in every request that goes to api there's property like

public Guid CompanyId {get; set;}

It is then checked with UserId from JWT token to check if user has access to that particular company.

I don't want that property to be in every call to the api. Is there a better way to approach that, like creating custom claim in JWT token?

It gets a bit more complicated cause users can have access to more that one company, so if I were to go with the custom claim, is there any way to refresh the token and change claim value in it?

asp.net-authorization jwt asp.net-core rest
1 Answers

You can have a similar function to issue Tokens for your users and pass in current session company Id and add it to them claims

public string IssueToken(Guid userId, Guid companyId)
{
  
  SigningCredentials siginingCredentials = new SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8.GetBytes("SuperSecretKey")), SecurityAlgorithms.HmacSha256Signature);

  JwtSecurityToken token = new JwtSecurityToken(
    issuer: "Issuer",
    audience: "Audience",
    expires: DateTime.UtcNow.AddMinutes(5),
    signingCredentials: siginingCredentials,
    claims: new List<Claim>
            {

                new Claim("companyId",companyId.ToString()),
                new Claim(JwtRegisteredClaimNames.Sub,userId.ToString())
            }
   );

   return new JwtSecurityTokenHandler().WriteToken(token);
}

and then later on you can access them by using HttpContextAccessor

Guid? UserId = Guid.Parse(_httpContextAccessor.HttpContext.User.FindFirstValue(ClaimTypes.NameIdentifier));
Guid? CompanyId = Guid.Parse(_httpContextAccessor.HttpContext.User.FindFirstValue("companyId"));
user_86580020
Related