CSLA .NET - Data Portal Security Configuration

[HaileMariamR]

Hi There CSLA community,

I was recently working on a project that utilizes the BLAZOR and CSLA.NET technologies. During my work, I encountered an issue where I needed to secure the data portal endpoint by overriding the default HttpProxy. Unfortunately, I faced some difficulties while attempting to configure this, I was unable to get sample of code anywhere, for that configuration. As a result, I am seeking guidance on how to properly configure on my client side (blazor web assembly project). I just shared the proxy that I was trying to configure.

using Csla;
using Csla.Channels.Http;
using System.Net.Http.Headers;

namespace cslabwasmsecurity
{
    public class CustomHttpProxy : HttpProxy
  
  {
    
        private readonly string _jwtToken;

        public CustomHttpProxy(ApplicationContext applicationContext, HttpClient httpClient, HttpProxyOptions options, string jwtToken) : base(applicationContext, httpClient, options)
        {
            _jwtToken = jwtToken;
        }

        protected override HttpClient GetHttpClient()
        {
            var client = base.GetHttpClient();
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", _jwtToken);
            return client;
        }

    }
}

Could someone who has experience with this security feature kindly provide the answer?

[rockfordlhotka]

(I fixed your code markup)

What are you trying to configure on the HttpClient? And do you need to configure it as the HtpClient is created? Or after it has been created (as you show here)?

[HaileMariamR]

In essence, my goal is to safeguard the data portal. The code sample I attached earlier only demonstrates the creation of an HttpProxy subclass. I am now seeking guidance on how to configure this HttpProxy subclass within a Blazor WebAssembly project. My question is similar to the one posted on the following link: #3284. Could you kindly provide any code snippet that could assist me in this endeavor?

[rockfordlhotka]

In Program.cs in the client project you do this:

var proxyOptions = new Csla.Channels.Http.HttpProxyOptions();
builder.Services.AddTransient(typeof(IDataPortalProxy),
  sp =>
  {
    var applicationContext = sp.GetRequiredService<ApplicationContext>();
    var client = applicationContext.GetRequiredService<HttpClient>();
    return new CustomHttpProxy(applicationContext, client, proxyOptions);
  }); 

builder.Services.AddCsla(o => o
  .AddBlazorWebAssembly());

This is basically the code from the UseHttpProxy method that you'd normally, call. You are just implementing that code yourself in Program.cs.

Alternately, in the file where you implement your custom proxy, you can also declare an extension method:

namespace Csla.Configuration
{
  /// <summary>
  /// Implement extension methods data portal channel
  /// </summary>
  public static class CustomHttpProxyExtensions
  {
    /// <summary>
    /// Configure data portal client to use HttpProxy.
    /// </summary>
    /// <param name="config">CslaDataPortalConfiguration object</param>
    /// <param name="options">Data portal proxy options</param>
    public static DataPortalClientOptions UseCustomHttpProxy(this DataPortalClientOptions config, Action<Csla.Channels.Http.HttpProxyOptions> options)
    {
      var proxyOptions = new Csla.Channels.Http.HttpProxyOptions();
      options?. Invoke(proxyOptions);
      config.Services.AddTransient(typeof(IDataPortalProxy),
        sp =>
        {
          var applicationContext = sp.GetRequiredService<ApplicationContext>();
          var client = sp.GetRequiredService<HttpClient>();
          return new CustomHttpProxy(applicationContext, client, proxyOptions);
        });
      return config;
    }
  }
}

And then in Program.cs you'd do this:

builder.Services.AddCsla(o => o
  .AddBlazorWebAssembly()
  .DataPortal(dpo => dpo
    .UseCustomHttpProxy(options => options.DataPortalUrl = "/api/DataPortal")));