Claims missing from x-ms-client-principal
- Dominant language
- No language data
- Stars
- 346
- Forks
- 67
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
When deserializing the x-ms-client-principal header the claims are missing; however, the claims can be seen at /.auth/me/
I will say though that the claims are available in the "StaticWebAppsAuthCookie". I can use this "StaticWebAppsAuthCookie" in development. However in an Azure Environment I can not use the StaticWebAppsAuthCookie because I cannot decrypt it.
To be a little more clear. The sample code has something like this
```csharp
var principal = new ClientPrincipal();
if (req.Headers.TryGetValues("x-ms-client-principal", out var header))
{
var data = header.First();
var decoded = Convert.FromBase64String(data);
var json = Encoding.UTF8.GetString(decoded);
principal = JsonSerializer.Deserialize(json, new JsonSerializerOptions { PropertyNameCaseInsensitive = true })!;
}
```
I realize that the sample code ClientPrincipal didn't have a claims property anyways so I tried to add it. I am using the following as my client principal
```csharp
using System.Security.Claims;
namespace Shared.Models
{
public class ClientPrincipal
{
public string IdentityProvider { get; set; } = null!;
public string UserId { get; set; } = null!;
public string UserDetails { get; set; } = null!;
public IEnumerable UserRoles { get; set; } = null!;
public IEnumerable? Claims { get; set; }
}
public class ClientPrincipalClaim
{
public string Typ { get; set; } = null!;
public string Val { get; set; } = null!;
}
}
```
Even with the property available to be copied, the claims are still missing.
If I use the following code locally. I get the claims that I want.
```csharp
private static ClientPrincipal GetClientPrincipal(HttpRequest req, ILogger log)
{
var principal = new ClientPrincipal();
var swaCookie = req.Cookies["StaticWebAppsAuthCookie"];
if(swaCookie != null)
{
log.LogInformation("SWA Cookie Found");
var decoded = Convert.FromBase64String(swaCookie);
log.LogInformation("SWA Cookie Decoded to a Byte Array");
var json = Encoding.UTF8.GetString(decoded);
log.LogInformation($"SWA Cookie JSON: {json}");
principal = JsonConvert.DeserializeObject(json);
log.LogInformation($"SWA Cookie Deserialized");
}
return principal;
}
```
However when I call this end point in production. The cookie is encrypted and thus not able to be read. In a standard c# api I would done something to decrypted the cookie, but I am not aware of how I could decrypt this cookie. So it seems that we need a way to either have the claims be present in the x-ms-client-principal header, or have a way to decrypt the StaticWebAppsAuthCookie within the runtime (maybe there already is)
**Expected behavior**
x-ms-client-principal header to contain the same information as /.auth/me
**Screenshots**
Screen shot of it from my local dev environment when being called from my client

Screen shot of the encrypted cookie in App Insights

Screen shot of that line of code in a break-point during local debug

Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.