question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Alternative access token query key for SignalR bearer authentication

See original GitHub issue

I have a custom authentication flow that involves attaching an access token to the headers/query string using a “token” key (url: ...?token={my-token}). I was able to set query strings on the old signalr ASP.NET JS client as the documentation states:

var connection = $.hubConnection(); connection.qs = { 'version' : '1.0' }; https://github.com/SignalR/bower-signalr/blob/bdc7cb4b255e41acf09a18f646a14732c163fcbb/jquery.signalR.js#L146-L153

However, the ASP.NET Core package version restricts (or rather standardizes) access tokens to be passed only through a “access_token” key:

https://github.com/aspnet/AspNetCore/blob/6cc99ea04f8254da4963740e627fc2e61b446063/src/SignalR/clients/ts/signalr/src/WebSocketTransport.ts#L41-L46

I believe it is due to the standard, but being able to set the key through IHttpConnectionOptions of the builder would be nice. something like:

HubConnectionBuilder().withUrl("/hubs/chat", { accessTokenFactory: () => this.loginToken, accessTokenKey: 'my-key' })

Alternatively, being able to set query string parameters (as in the old package) would be a great too.

Any thoughts on the idea? I would be glad to make a PR for this feature.

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Comments:5 (3 by maintainers)

github_iconTop GitHub Comments

1reaction
analogrelaycommented, Nov 21, 2019

@mikeChatsky That sounds like the best approach for now. I do recognize the value of being able to change the query string option but I’m not yet sure it’s worth the overhead of new public options APIs. We can keep an eye out for other cases where users can’t refactor quite so easily and revisit this in the future.

1reaction
analogrelaycommented, Nov 20, 2019

Couldn’t you also just do this by setting a query string token in the URL or using a header? Like this:

new HubConnectionBuilder().withUrl(`/hubs/chat?token=${this.loginToken}`)

If you need to “refresh” it with new values, you could also provide a custom HttpClient implementation by setting the httpClient property.

Read more comments on GitHub >

github_iconTop Results From Across the Web

How to make SignalR Bearer Authentication Secure OR ...
I've resorted to take an approach where the JWT token does need to be sent as part of the query string, as explained...
Read more >
ASP.NET Core and SignalR Authentication (with the ...
If you are using the SignalR JavaScript client you'll realise that the access token is passed as a query parameter.
Read more >
Authentication and authorization in ASP.NET Core SignalR
Bearer token authentication. The client can provide an access token instead of using a cookie. The server validates the token and uses it...
Read more >
Securing your SignalR applications with OpenID Connect and ...
The function placed inside withAccessTokenProvider call will return a string, which will be applied as the bearer token. And this concludes the ...
Read more >
JWT Tokens, SignalR and Single Page Applications
A new-ish alternative to session-based cookies that's well-suited to single page apps is token-based authentication.
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found