I am working on Web Api call to authenticate using Auth0. I am able to get token
but when I am making calls to Web Api to get it is giving UnAuthorize 401 even I am sending the Authorize. Below is my code in Web Api project:
Call to Auth0 to authticate and get token
Related
I have created a small .NET 5.0 Web API where a users can register/login to create/add/delete notes. The API is working fine, after the login I receive the JWT token in the response back.
Now I want to create a Blazor Webassembly website which will communicate with the API.
The problem I have is that I don't know where to start and what do I need to get the web page take the Token from the response and how to work with it to be authorized when doing API calls.
In the API i have used the IHttppAccesor to get access to the user data from the JWT token, is it similar to work with the token for the authorization.
Any suggestions what to use or where to start would be greatly appreciated!
I'm in a scenario where there is a Blazor app that has to be protected.
This app need a login on local user store or external auth on google or facebook or MS.
There is a asp.net core project that expose all the API for this Blazor app.
All API are protected [Authorize] and this api project implement also the login api that generate the JWT token.
Whit a local login, the login page was on the Blazor app that called login api, managed the response retriving JWT and store in the local storage. For each request Blazor app sent JWT token to authorized api.
How to manage External Authentication in this case? Is Blazor app that has to generate the call to Google, facebook,... and then the google callback will call the api project to generate the jwt ?
I cannot understand how to let the flow work, as api are protected by JWT, and I guess external authentication has to callback the api to generate jwt, but I how to return back to the Blazor app?
I dont' want to use Identity Server 4 , but I could externalize login page on api project.
I am creating a new .Net Core Web API that is consumed by a new React client-side app. Both the client-side app and the Web API are on different hosts and protected by Auth0. I set up both the client-side app and the Web API in Auth0, and then I created a machine-to-machine app in Auth0 to be able to communicate with the Web API silently (without a user interface). The security flow works like this:
User tries to access client-side app.
User is re-directed to Auth0 to provide credentials.
Auth0 authenticates the credentials and returns user info (including user ID + access token) to client-side app.
Client-side app stores user info in local storage for future use until it expires.
Any calls to 3rd party APIs are routed through my own Web API, so 3rd party API keys are sitting in a safe place on the server, not on the client-side.
User accesses a page that requires a call to my Web API but we don't have an access token for my Web API yet.
Client-side app reads the ClientId & ClientSecret (hard-coded values) from .env file and makes a POST request to Auth0 to fetch an access token for my Web API (this is Auth0's recommended way of getting the access token for the Web API silently except they don't specify where the ClientId & ClientSecret would be stored).
Auth0 returns an access token for my Web API.
Client-side app stores the Web API access token in local storage for future use until it expires.
Client-side app invokes my Web API with newly acquired access token as the bearer token in the header.
Web API receives the access token, authenticates with Auth0 and fulfills the request.
All of the above is working for me but I am concerned about storing the Auth0 ClientSecret of my Web API in the client-side app. Although it is not visible on the screen or in a cookie anywhere, any capable user would be able to get at it by inspecting the network traffic.
Many people on the Internet seem to be fine with storing 3rd party API keys in .env files while others advise routing 3rd party API access through your own Web API ... and I am doing the latter. But I still need the Auth0 ClientSecret to get to my own Web API and I cannot figure out a better place way to get to it without storing them somewhere on the client-side.
One last-ditch solution I can think of is to not protect my Web API through Auth0 and instead every call from the client-side app to my Web API should include something unique (like the user ID from Auth0) that can be validated by the Web API. Thankfully, the user ID from Auth0 will be stored in our database when the user is set up initially, so this is actually possible.
Does Auth0 have any other way for me to get the Web API access token without providing the ClientSecret given that I already have the client-side app's access token? I am curious to know how others have secured both their client-side app and their Web API through Auth0.
You are correct, you should not include the client secret in your client-side app. Do not use a client credentials flow, instead use a auth code + PKCE or implicit flow.
With that being said, Auth0 should handle most of that if you are using a library or SDK.
You have two options for getting the token:
When requesting the initial access token and ID token add the Web API as an audience and request the related scopes.
Make a silent request using the checkSession function for Auth0.js or getTokenSilently for auth0-spa-js
Take a look at this:
https://auth0.com/docs/architecture-scenarios/spa-api/part-3
I am trying to call the web service from mule which requires the access token for authorization. We have to generate the token from token URL and then we need to pass that token in Authorization to get the result from the web service.
I have written the Java Program to generate the access token, and it is working fine. But when i am trying to access the API with the generated Token it is giving the below error:
Error sending HTTP request.
I've created some API for my application, all the APIs are for the authenticate user except one which is used to make user authenticate.
I am maintaining all the APIs in swagger. Everything working fine. I am calling the first API to make user authenticate
www.example.com/endpoint/registerDevice I got the expected result but when I called the second API and got the result as error message you are not the authenticate user then I realized that swagger is not persisted the session cookie.
Is there any way to make all the API working in swagger?
I am using swagger 2.0 and I've hosted swagger on my server.