websockets and authentication with identityserver4

Question

I am using .net core 1.1 and identityserver 4 to get tokens and validate users. The web api works fine reading the bearer token from the headers and getting the user principal claims.

Now I want to use a websocket (not SignalR) for sending notifications. I can open a ws:// channel (or wss) but token isn't sent with the headers, so in the .net core application I have no information of the user (User Claims and Identity).

How can I authenticate the user through the websocket? I did a search but couldn't find any helpful information.

Thanks

Answer 1

There are two main problems related to the authentication in WebSocket middleware:

Authorization should be called manually

First of all, authorization is not applied to web socket request (as it is not a controller which can be marked with Authorize attribute). That's why in WebSocket middleware you need to call authorization by your self. This is easy to achieve by calling AuthenticateAsync extension method of the HttpContext object.

So, your middleware will be look something like this:

public class WebSocketMiddleware
{
    private readonly RequestDelegate next;
    public WebSocketMiddleware(RequestDelegate next)
    {
        this.next = next;
    }

    public async Task Invoke(HttpContext context)
    {
        if (!context.WebSockets.IsWebSocketRequest)
        {
            await this.next.Invoke(context);
            return;
        }

        AuthenticateResult authenticateResult = 
            await context.AuthenticateAsync(OAuthValidationDefaults.AuthenticationScheme);

         ....
        });
    }

So, using authentication results you can check if the user is authenticated or not and then access authenticated user information.

Passing bearer token to web sockets request

For Web Socket connections, the default Authorization header does not work, because the WebSockets JS API doesn't allow setting custom parameters. To work around this limitation, the access token is passed quite often in the query string.

To make authentication middleware to use it, you need to update authentication validation options. This basically can be done in your startup script like this:

services
    .AddAuthentication()
    .AddOAuthValidation(options =>
    {
        options.Events = new OAuthValidationEvents
        {
            // Note: for Web Socket connections, the default Authorization header does not work,
            // because the WebSockets JS API doesn't allow setting custom parameters.
            // To work around this limitation, the access token is retrieved from the query string.
            OnRetrieveToken = context =>
            {
                context.Token = context.Request.Query["access_token"];
                return Task.FromResult(0);
            }
        };
    });

The following code can be used as an example to add access token to web socket url during connection initializing:

const protocol = location.protocol === "https:" ? "wss:" : "ws:";
const wsUri = protocol + "//" + window.location.host + "/ws" + "?access_token=" + token;
this.socket = new WebSocket(wsUri);