Azure / Azure/static-web-apps

Claims missing from x-ms-client-principal

Open
#897 30 comments 4 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
346
Forks
67
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

When deserializing the x-ms-client-principal header the claims are missing; however, the claims can be seen at /.auth/me/

I will say though that the claims are available in the "StaticWebAppsAuthCookie". I can use this "StaticWebAppsAuthCookie" in development. However in an Azure Environment I can not use the StaticWebAppsAuthCookie because I cannot decrypt it.

To be a little more clear. The sample code has something like this

```csharp
var principal = new ClientPrincipal();

if (req.Headers.TryGetValues("x-ms-client-principal", out var header))
{
var data = header.First();
var decoded = Convert.FromBase64String(data);
var json = Encoding.UTF8.GetString(decoded);
principal = JsonSerializer.Deserialize(json, new JsonSerializerOptions { PropertyNameCaseInsensitive = true })!;
}
```

I realize that the sample code ClientPrincipal didn't have a claims property anyways so I tried to add it. I am using the following as my client principal

```csharp
using System.Security.Claims;

namespace Shared.Models
{
public class ClientPrincipal
{
public string IdentityProvider { get; set; } = null!;
public string UserId { get; set; } = null!;
public string UserDetails { get; set; } = null!;
public IEnumerable UserRoles { get; set; } = null!;
public IEnumerable? Claims { get; set; }
}

public class ClientPrincipalClaim
{
public string Typ { get; set; } = null!;
public string Val { get; set; } = null!;
}
}
```

Even with the property available to be copied, the claims are still missing.

If I use the following code locally. I get the claims that I want.

```csharp
private static ClientPrincipal GetClientPrincipal(HttpRequest req, ILogger log)
{
var principal = new ClientPrincipal();

var swaCookie = req.Cookies["StaticWebAppsAuthCookie"];

if(swaCookie != null)
{
log.LogInformation("SWA Cookie Found");
var decoded = Convert.FromBase64String(swaCookie);
log.LogInformation("SWA Cookie Decoded to a Byte Array");
var json = Encoding.UTF8.GetString(decoded);
log.LogInformation($"SWA Cookie JSON: {json}");
principal = JsonConvert.DeserializeObject(json);
log.LogInformation($"SWA Cookie Deserialized");
}

return principal;
}
```

However when I call this end point in production. The cookie is encrypted and thus not able to be read. In a standard c# api I would done something to decrypted the cookie, but I am not aware of how I could decrypt this cookie. So it seems that we need a way to either have the claims be present in the x-ms-client-principal header, or have a way to decrypt the StaticWebAppsAuthCookie within the runtime (maybe there already is)

**Expected behavior**
x-ms-client-principal header to contain the same information as /.auth/me

**Screenshots**
Screen shot of it from my local dev environment when being called from my client
![image](https://user-images.githubusercontent.com/959240/186186810-71bbeab7-3179-4390-b149-c5069b7fd7c9.png)

Screen shot of the encrypted cookie in App Insights
![image](https://user-images.githubusercontent.com/959240/186188465-2d500560-198f-49c5-9774-9f11ed3be51e.png)

Screen shot of that line of code in a break-point during local debug
![image](https://user-images.githubusercontent.com/959240/186188902-d4512f92-cbaf-4ef4-b398-fd8e1a1d2ee1.png)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.