WebAuthentication in Local Development with DevTunnels

[borrmann]

I am currently trying to implement WebAuthentication with Microsoft/ Apple/ Google sign-in in my application.
How can I redirect the responses from the authentication servers to a devtunnel?
All the tutorials publish the web service to Azure or use direct authentication from the mobile device without going through a backend. The docs say, for security reasons it is highly recommended to use the way through the backend, but at this point this seems hard to develop, because the devices (emulator/ simulator) can't connect to the localhost. In the backend, I can modify the CallbackPath, but I am not able to figure out how to redirect to the devtunnel.

[borrmann]

related issue

[borrmann]

So, I finally got it to work. The last issue seems to have something to do with the Browser. because I was able to sign-in with an android emulator by manually calling the correct controller method after signing in and landing on the signin-google 500 error page. This means, the cookie was set correctly but something seems to go wrong in the GoogleHandler.

By manually catching the specific Error in Startup.cs, I was able to overcome this issue;

app.Use((context, next) =>
            {
                context.Request.Host = new HostString("{MYDEVTUNNEL}-5001.uks1.devtunnels.ms");
    
                //context.Request.PathBase = new PathString("/2.1.9"); //if you need this
                context.Request.Scheme = "https";
                return next();
            });

app.UseForwardedHeaders();

app.UseExceptionHandler(exceptionHandlerApp =>
            {
                exceptionHandlerApp.Run(async context =>
                {
                    if (context.Request.Path.Value.Contains("signin-google"))
                    {
                        context.Response.Redirect("/api/Authenticate/Google");
                    }

                    if(env.IsDevelopment())
                    {
                        exceptionHandlerApp.UseDeveloperExceptionPage();
                    }
                });
            });

and

services.Configure<ForwardedHeadersOptions>(options =>
            {
                options.ForwardedHeaders =
                    ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
            });

services
             .AddAuthentication(x =>
            {
                x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            })
            .AddCookie()
            .AddJwtBearer(x =>
            {
                x.Events = new JwtBearerEvents
                {
                    OnTokenValidated = context =>
                    {
                        var userMachine = context.HttpContext.RequestServices.GetRequiredService<UserManager<ApplicationUser>>();
                        var user = userMachine.GetUserAsync(context.HttpContext.User);
                        if (user == null)
                        {
                            context.Fail("UnAuthorized");
                        }
                        // TODO
                        return Task.CompletedTask;
                    }
                };
                x.RequireHttpsMetadata = false;
                x.SaveToken = true;
                //x.ClaimsIssuer = ApiRoutes.UrlBase;
                x.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuerSigningKey = true,
                    IssuerSigningKey = new SymmetricSecurityKey(key),
                    ValidateIssuer = false,
                    ValidateAudience = false
                };
            })
            .AddGoogle(g =>
            {
                g.ClientId = Configuration["Authentication:Google:ClientId"];
                g.ClientSecret = Configuration["Authentication:Google:ClientSecret"];
                g.SaveTokens = true;
            });