dotnet / dotnet/AspNetCore.Docs

Configuring SignalR Core hub's bearer token auth

Open
#12,340 11 comments 0 reactions 0 assignees View on GitHub
doc-enhancement SignalR Source - Docs.ms
Dominant language
C#
Stars
13.1k
Forks
24.6k
Avg merge
1d 3h
Merged PRs (30d)
97

Description

The [Bearer token authentication](https://docs.microsoft.com/en-us/aspnet/core/signalr/authn-and-authz?view=aspnetcore-2.2#bearer-token-authentication) section says:

> In standard web APIs, bearer tokens are sent in an HTTP header. However, SignalR is unable to set these headers in browsers when using some transports. When using WebSockets and Server-Sent Events, the token is transmitted as a query string parameter. In order to support this on the server, additional configuration is required...

The doc then continues with an entire `ConfigureServices` method implementation from a sample app.

I configured my .NET client app to provide a token, and it's correctly doing so, but I see it's arriving at the hub in the authentication header. I confirmed the connection is using WebSockets as the transport. The token isn't in the query string as the doc says. Without adding any of the bits from the doc's sample `ConfigureServices` method implementation, the claims are available in the hub.

That's nice it worked, but it's also confusing since I don't understand why it worked. Why do the docs say I must "Read the token out of the query string", and provide code for doing so, but it's unnecessary in my case. Is my scenario somehow unusual?

I'm using Azure AD B2C so my `ConfigureServices` method resembles the one in the Asp.Net Core 2.2 template for "Individual Accounts" authentication. I wasn't sure which part from the sample `ConfigureServices` implementation I'd need, so I got started by adding the `Authorize` attribute to my SignalR Core hub. I expected an auth exception to be thrown, but there wasn't one! The claims are populated, without any of the configuration shown in the doc.

---
#### Document Details

⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*

* ID: d0da2144-3730-f8ef-1d16-a89f11fd6198
* Version Independent ID: 6d8f5bc8-8f5c-ba13-b7f2-0366eac46f81
* Content: [Authentication and authorization in ASP.NET Core SignalR](https://docs.microsoft.com/en-us/aspnet/core/signalr/authn-and-authz?view=aspnetcore-3.0)
* Content Source: [aspnetcore/signalr/authn-and-authz.md](https://github.com/aspnet/AspNetCore.Docs/blob/master/aspnetcore/signalr/authn-and-authz.md)
* Product: **aspnet-core**
* Technology: **aspnetcore-signalr**
* GitHub Login: @bradygaster
* Microsoft Alias: **bradyg**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.