Skip to content

Commit 590aa1f

Browse files
leungkimming1leungkimming1
committed
change jwt to cookie
1 parent bf2782c commit 590aa1f

24 files changed

+159
-64
lines changed

‎API/Controllers/DocumentProcessingController.cs‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
using API;
22
using DocumentProcessing;
3-
using Microsoft.AspNetCore.Authorization;
43
using Microsoft.AspNetCore.Mvc;
5-
using System.Diagnostics;
64
using System.Globalization;
75
using System.Net.Http.Headers;
86
using Telerik.Documents.Common.Model;
@@ -23,7 +21,6 @@
2321

2422
[ApiController]
2523
[Route("documentprocessing")]
26-
[Authorize]
2724
public class DocumentProcessingController : ControllerBase {
2825

2926
private readonly IPdfProcessing _pdfProcessing;

‎API/Controllers/LoginController.cs‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,39 +25,46 @@ public LoginController(IConfiguration config,
2525
}
2626

2727
[HttpGet(Name = "Login")]
28-
public async Task<IActionResult> Get() {
28+
public async Task<IActionResult> Get(bool force) {
2929
JwtSecurityToken jwtToken;
3030
string token;
31-
AuthResult authResult;
31+
AuthResult authResult = new AuthResult();
32+
RefreshTokenResponse refreshTokenDTO = new RefreshTokenResponse() {
33+
sRefreshToken = "",
34+
TokenExpiry = null,
35+
Success = true,
36+
Message = ""
37+
};
3238

3339
if (HttpContext.User.Identity!.Name == "" || HttpContext.User.Identity.Name == null) {
3440
throw new InvalidUserException();
3541
}
3642

37-
if (jwtUtil.ValidateToken(HttpContext.Request, out jwtToken, out token)) {
43+
if (!force && jwtUtil.ValidateToken(HttpContext.Request, out jwtToken, out token)) {
44+
refreshTokenDTO.TokenExpiry = jwtToken.ValidTo;
45+
refreshTokenDTO.Message = "Not Yet Expired";
3846
if (HttpContext.User.Identity.Name == jwtToken.Claims
3947
.Where(c => c.Type == ClaimTypes.Name)
4048
.Select(c => c.Value).SingleOrDefault()) {
4149
Array.ForEach(jwtToken.Claims.Where(c => c.Type == ClaimTypes.Role)
4250
.ToArray(), c => ((ClaimsIdentity)HttpContext.User.Identity).AddClaim(c));
4351
}
44-
authResult = new AuthResult() {
45-
Token = token,
46-
Success = true,
47-
RefreshToken = ""
48-
};
4952
} else {
5053
List<Claim>? claims = _service.GetUserClaims(HttpContext.User.Identity.Name);
5154

5255
ClaimsIdentity claimsIdentity = (ClaimsIdentity)HttpContext.User.Identity;
5356
Array.ForEach(claims.Where(c => c.Type == ClaimTypes.Role).ToArray(),
5457
c => claimsIdentity.AddClaim(c));
5558
authResult = jwtUtil.GenerateJwtToken(HttpContext.User.Identity.Name, claims);
59+
HttpContext.Response.Cookies.Append("X-UserRoles", authResult.Token!,
60+
new CookieOptions() { HttpOnly = true });
61+
refreshTokenDTO.sRefreshToken = authResult.RefreshToken;
62+
refreshTokenDTO.Message = "New Token generated";
5663
}
5764

5865
AntiforgeryTokenSet? tokens = antiforgery.GetAndStoreTokens(HttpContext);
5966
HttpContext.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken!, new CookieOptions() { HttpOnly = false });
6067

61-
return Ok(authResult);
68+
return Ok(refreshTokenDTO);
6269
}
6370
}

‎API/Controllers/ReportController.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
namespace API {
66
[Route("reports")]
77
[ApiController]
8+
[AccessCodeAuthorize("RA01")]
89
[IgnoreAntiforgeryToken]
910
public class ReportsController : ReportsControllerBase {
1011
public ReportsController(IReportServiceConfiguration reportServiceConfiguration)

‎API/Controllers/RuntimeInfoController.cs‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,12 @@
33
using System.Runtime.InteropServices;
44
using System.Security.Principal;
55
using System.Security.Claims;
6-
using Microsoft.AspNetCore.Authorization;
76
using System.IdentityModel.Tokens.Jwt;
8-
using Microsoft.AspNetCore.Authentication.Negotiate;
97

108
namespace API;
119

1210
[ApiController]
1311
[Route("RuntimeInfo")]
14-
[Authorize(AuthenticationSchemes = NegotiateDefaults.AuthenticationScheme)]
1512
[IgnoreAntiforgeryToken]
1613
public class RuntimeInfoController : ControllerBase {
1714
private IConfiguration _conf { get; set; }

‎API/Controllers/SystemParameters/SystemParametersController.cs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,4 @@
11
using Common;
2-
using Microsoft.AspNetCore.Authentication.Negotiate;
3-
using Microsoft.AspNetCore.Authorization;
42
using Microsoft.AspNetCore.Mvc;
53
using Service;
64

‎API/Controllers/UserController.cs‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
using Service;
44
using Data;
55
using System.Net;
6-
using Business;
76

87
namespace API {
98
[ApiController]

‎API/Jwt/AuthResult.cs‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
using System.Collections.Generic;
2+
3+
namespace API {
4+
public class AuthResult {
5+
public string Token { get; set; }
6+
public string RefreshToken { get; set; }
7+
public bool Success { get; set; }
8+
public List<string> Errors { get; set; }
9+
}
10+
}

‎API/Jwt/CustomHeaderSwaggerAttribute.cs‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,14 @@ public class CustomHeaderSwaggerAttribute : IOperationFilter {
66
public void Apply(OpenApiOperation operation, OperationFilterContext context) {
77
if (operation.Parameters == null)
88
operation.Parameters = new List<OpenApiParameter>();
9-
10-
operation.Parameters.Add(new OpenApiParameter {
11-
Name = "X-UserRoles",
12-
In = ParameterLocation.Header,
13-
Required = false,
14-
Schema = new OpenApiSchema {
15-
Type = "string"
16-
}
17-
});
9+
//operation.Parameters.Add(new OpenApiParameter {
10+
// Name = "X-UserRoles",
11+
// In = ParameterLocation.Header,
12+
// Required = false,
13+
// Schema = new OpenApiSchema {
14+
// Type = "string"
15+
// }
16+
//});
1817
operation.Parameters.Add(new OpenApiParameter {
1918
Name = "X-CSRF-TOKEN-HEADER",
2019
In = ParameterLocation.Header,

‎API/Jwt/JWTUtil.cs‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
using Microsoft.IdentityModel.Tokens;
55
using Common;
66
using Business;
7+
using Microsoft.Extensions.Primitives;
78

89
namespace API {
910
public class JWTUtil : IJWTUtil {
@@ -35,7 +36,7 @@ public JWTUtil(IConfiguration config) {
3536
}
3637

3738
public bool ValidateToken(HttpRequest request, out JwtSecurityToken jwtToken, out string token) {
38-
var tokens = request.Headers["X-UserRoles"];
39+
StringValues tokens = request.Cookies["X-UserRoles"];
3940
if (tokens.Any()) {
4041
token = tokens[0];
4142
try {
@@ -67,7 +68,9 @@ public AuthResult GenerateJwtToken(string user, List<Claim> claims) {
6768
};
6869
var token = tokenHandler.CreateToken(tokenDescriptor);
6970
var jwtToken = tokenHandler.WriteToken(token);
70-
71+
if (jwtToken.Length > (4096 - 13)) { //limit - cookie key
72+
throw new CookieSizeExceedLimitException();
73+
}
7174
var refreshToken = new RefreshToken()
7275
{
7376
JwtId = token.Id,

‎API/Program.cs‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,6 @@
7777
// Authentication, authorization, Antiforgery Token
7878
builder.Services.AddAuthentication(HttpSysDefaults.AuthenticationScheme);
7979
builder.Services.AddAuthentication(IISServerDefaults.AuthenticationScheme);
80-
builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme);
8180
if (!builder.Environment.IsDevelopment()) {
8281
builder.WebHost.UseHttpSys(options => {
8382
options.Authentication.Schemes = AuthenticationSchemes.Negotiate | AuthenticationSchemes.NTLM;

0 commit comments

Comments
 (0)