I am attempting to authorize SignalR requests exactly using the sample project here AngularJS Authentication based on this project AngularJS Authentication using web tokens. The problem I am having is, to use SignalR authorization, I had to override the SignalR AuthorizeAttribute
class as below:
public class QueryStringBearerAuthorizeAttribute : AuthorizeAttribute
{
public override bool AuthorizeHubConnection(HubDescriptor hubDescriptor, IRequest request)
{
var token = request.QueryString.Get("Bearer");
var authenticationTicket = Startup.AuthServerOptions.AccessTokenFormat.Unprotect(token);
if (authenticationTicket == null || authenticationTicket.Identity == null || !authenticationTicket.Identity.IsAuthenticated)
{
return false;
}
request.Environment["server.User"] = new ClaimsPrincipal(authenticationTicket.Identity);
request.Environment["server.Username"] = authenticationTicket.Identity.Name;
request.GetHttpContext().User = new ClaimsPrincipal(authenticationTicket.Identity);
return true;
}
public override bool AuthorizeHubMethodInvocation(IHubIncomingInvokerContext hubIncomingInvokerContext, bool appliesToMethod)
{
var connectionId = hubIncomingInvokerContext.Hub.Context.ConnectionId;
var environment = hubIncomingInvokerContext.Hub.Context.Request.Environment;
var principal = environment["server.User"] as ClaimsPrincipal;
if (principal != null && principal.Identity != null && principal.Identity.IsAuthenticated)
{
hubIncomingInvokerContext.Hub.Context = new HubCallerContext(new ServerRequest(environment), connectionId);
return true;
}
return false;
}
}
Now my hub is as below:
[QueryStringBearerAuthorize]
[HubName("realtime")]
public class WislerAppHub : Hub
{
public string GetServerTime()
{
return DateTime.UtcNow.ToString();
}
}
The idea is, when a signalr connection request hits this class, the AuthorizeHubConnection
should fire and authorize it. However this method is never called. The second method, AuthorizeHubMethodInvocation
is called though.
What am I doing wrong? Why isn't this override working? BTW I tried inheriting thus: QueryStringBearerAuthorizeAttribute : Attribute, IAuthorizeHubConnection, IAuthorizeHubMethodInvocation
with the same result.
Thank you.