Differentiate between the first request (authentication) and subsequent requests (also authentication) - authentication

Question

Using basic authentication I do this in my authentication handler:
protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, System.Threading.CancellationToken cancellationToken)
{
var authHeader = request.Headers.Authorization;
if (authHeader == null || authHeader.Scheme != BasicScheme)
{
return CreateUnauthorizedResponse();
}
// Now authenticate the user with his name+pw
// Return Auth token to user
}
Every time that means the first request or all subsequent requents the user request will go through the above SendAsnyc method. How should I differentiate in the above method wether the user want to authenticate himself (having username+password) the first time or authenticate himself (having the server generated auth token) all further times?

Answer 1

Two options.
(1) Assuming that the token that is sent back from the server after successful authentication of username/password is sent in the Authorization header for subsequent requests (in a different scheme), rearrange your logic so that you look for basic scheme in authorization header and if present, authenticate and send back the token. If authz header with basic scheme is not present but your scheme or bearer scheme (whatever that is) is present, assume it is token and authenticate. If authz header is not present or if credentials in basic scheme is invalid or the token in the other scheme is invalid, send 401.
(2) Change the message handler so that it only does basic scheme authentication. If header is absent or invalid credentials or present, it just will not set the correct principal in request.GetRequestContext().Principal but does not send back 401. Introduce another message handler that will perform the authentication of token. This handler sets the correct principal only when the token is present in the request and token is valid. Again, this handler does not send back 401. Finally, apply Authorize filter at action method, controller or even globally. Filter will set the response status to 401, if an authenticated identity is not established by both message handlers.
I prefer the second one because the handlers have single responsibility of authentication. BTW, it is generally not recommended to use message handler to do authentication. The identity you establish here will be reverted back, once the execution goes back to IIS pipeline (assuming you use IIS).

Answer 2

You can use the authorization scheme to differentiate. When the user is sending a username/password then use the "basic" auth scheme. When sending a token, use the "bearer" auth scheme.