how do you request a session from servicestack basic authentication, at /auth/basic?

3
votes

I have set up a servicestack service with basic authentication using the first example, here: https://github.com/ServiceStack/ServiceStack/wiki/Authentication-and-authorization

This automatically sets up a route: /auth/basic However, I cannot find any information or examples on how to format a request to this URL (Variables/GET/POST/Auth Header, etc.).

I am able to access a simple service using the basic authentication credentials, so they are active and correct.

I have no custom authentication plugged in, just basic authentication.

I have tried:

  • Using a JsonServiceClient to send UserName and Password variables by GET or Json POST to /auth/basic, with and without an Auth header also containing the user & pass.

  • Using a browser to send GET requests with URL parameters of the user/pass, or as http://user:pass@localhost:123/auth/basic

I always just get "HTTP/1.1 401 Invalid BasicAuth credentials".

The only examples I can find involve some kind of custom authentication, and then /auth/credentials is accessed, but I want to use /auth/basic

I have looked at the code and it looks like it reads an Auth header, but the service does not accept one.

I am actually trying to get this working so I can then disable it and verify it is disabled (I want to require basic authentication for every request).

Questions are:

  • What is the correct way to call the /auth/basic service? I will take a servicestack client API example, specifications or even a raw http request!

  • How do you disable the /auth services altogether?

Many thanks.

2
authenticationservicestackbasic-authentication

2 Answers

1
votes

What is the correct way to call the /auth/basic service? I will take a servicestack client API example, specifications or even a raw http request!

var client = new JsonServiceClient("http://localhost:56006/api");
var resp = client.Post(new Auth() { UserName = "TestUser", Password = "Password" });
  • This assumes you have also registered an ICacheClient and IAuthUserRepository (and added a user account)

The JSON format looks like this if you call into /auth/basic?format=json

{
  "UserName": "admin",
  "Password": "test"
  "RememberMe": true
}

How do you disable the /auth services altogether?

Don't add the AuthFeature plugin to configuration.

You can also remove plugins 

Plugins.RemoveAll(x => x is AuthFeature);
-1
votes

Putting the following in apphost config seems to do the trick.

//Disable most things, including SOAP support, /auth and /metadata routes
SetConfig(new EndpointHostConfig()
{
    EnableFeatures = Feature.Json | Feature.Xml
});

I am a little suspicious about what this does to /auth however, because it returns an empty response, while most routes return 404.

So, would this truly disable the /auth functionality? As in, if someone formed a correct request to /auth/credentials, will it still return an empty response?