When ServiceStack authentication fails, do not redirect?

10
votes

We're building a ServiceStack API which will use Basic authentication. I've currently set up the auth in my AppHost as follows:

var authDb = new OrmLiteConnectionFactory("Server=(...);", true, MySqlDialectProvider.Instance);

var authRepo = new OrmLiteAuthRepository(authDb);
authRepo.CreateMissingTables();
container.Register<ICacheClient>(c => new MemoryCacheClient());
container.Register<IUserAuthRepository>(c => authRepo);

Plugins.Add(
    new AuthFeature(() => new AuthUserSession(), new IAuthProvider[] { new BasicAuthProvider() })
);

When doing a request with no Authorization header or the wrong username+pass the response is a redirect to /Account/Login.aspx?ReturnUrl=...

Parital request + response example:

POST http://localhost:60278/reserve HTTP/1.1

HTTP/1.1 302 Found
Location: /Account/Login.aspx?ReturnUrl=%2freserve
X-Powered-By: ServiceStack/3,924 Win32NT/.NET

Is there a way to make it respond with only a HTTP 401 Unauthorized or a HTTP 403 Forbidden ?

2
.netauthenticationservicestack

2 Answers

22
votes

By default ServiceStack's AuthFeature will only try to redirect you to the default ~/login path for HTML Content-Type requests. You can override this by setting the redirect path in the AuthFeature to null:

Plugins.Add(new AuthFeature(...) { HtmlRedirect = null });

This will fall back to the standard 401 UnAuthorized Response that the other Content-Types get.

After globally setting the HtmlRedirect to null, you can add it back on an adhoc basis, e.g:

[Authenticate(HtmlRedirect="~/path/to/redirect/to")]
1
votes

If the following doesn't work:

Plugins.Add(new AuthFeature(...) { HtmlRedirect = null });

Try setting the OverrideHtmlRedirect = false to the provider. This works for the NetCoreIdentityAuthProvider- especially for JWT bearer authentication

Plugins.Add(
  new AuthFeature(..., 
  new CustomAuthProvider(AppSettings) { OverrideHtmlRedirect = false }
) { HtmlRedirect = null });

If all else fails, check the Github code to see if there's an html redirect being forced