302 redirect on Challenge handler - 401 expected

[davidsteelebrady]

During an upgrade of net6.0 -> net.8.0 and v3.x of the NEasyAuthMiddleware has proven somewhat problematic.

We have existing automated tests (xunit) that check for scenarios involving unauthenticated clients with expectations and assertions of a 401 return from our controllers. The default behaviour of v2.*.

Changes made under #15, initiated by issue #11 now mean that auth middleware returns a redirect 302 when we verify.

Adopting a workaround similar to that under #11 resolves this issue for the moment but would it be possible for EasyAuthOptions to be extended with a "NoRedirectOnChallenge" property?

builder.Services.AddEasyAuth(
    o =>
    {
        o.ForwardChallenge = o.ForwardSignOut = "MyEasyAuth";
    })
    .AddScheme<EasyAuthOptions, EasyAuthSignOutAuthenticationHandler>("MyEasyAuth", _ => { });

internal class EasyAuthNoChallengeAuthenticationHandler : AuthenticationHandler<EasyAuthOptions>
{
    public EasyAuthNoChallengeAuthenticationHandler(
        IOptionsMonitor<EasyAuthOptions> options,
        ILoggerFactory logger,
        UrlEncoder encoder) : base(options, logger, encoder) { }

    protected override Task<AuthenticateResult> HandleAuthenticateAsync() => throw new NotImplementedException();
}

[dasiths]

Just to understand this request clearly.

You are proposing an option to control the these two methods in NEasyAuthMiddleware/Core/EasyAuthAuthenticationHandler.cs?

        protected override Task HandleChallengeAsync(AuthenticationProperties properties) 
        {
            Response.Redirect($"/.auth/login/{Options.Provider}?post_login_redirect_uri={Request.GetEncodedPathAndQuery()}");
            return Task.CompletedTask;
        }

        protected override Task HandleSignOutAsync(AuthenticationProperties properties)
        {
            Response.Redirect("/.auth/logout");
            return Task.CompletedTask;
        }

What do you propose here? Throwing an exception?

[dasiths]

For example we could just do this https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/Core/src/AuthenticationHandler.cs#L299

[Euan-McVie]

@dasiths - Correct, Our APIs are M2M only so prefer the original behaviour as inherited from the base AuthenticationHandler.

You can ignore the exception in the workaround as it is never used to authenticate and was just so we could reset it to the base behaviour for the challenge.

Maybe all the "NoRedirects" option flag needs to do is call the base in the new overridden methods and early exit, instead of the new forwarding implementations?