Authorization extensions for ServiceStack

2
votes

Is there any (or going to be any) built in support for declaratively securing (i.e. using attributes) REST services for oAuth2?

I would like to specify that the REST services of my SS web service can only be accessed by a client if they specify the oAuth2 'Authorization' header in their request to the service.

I don't want my service to provide authentication to my clients (i.e. no AuthFeature). Clients need to have already done authentication with a oAuth service (i.e. facebook etc.).

1
servicestack

1 Answers

1
votes

Using the [Authenticate] attribute on your Service ensures that only authenticated clients have access.

The Authentication wiki explains how to initialize ServiceStack's built-in AuthFeature to specify only the providers you want to allow clients to authenticate with, e.g. You can ensure clients can only Authenticate with either LinkedIn or Google OAuth2 providers with:

var appSettings = new AppSettings();            //Access Web.Config AppSettings
Plugins.Add(new AuthFeature(() => new CustomUserSession(), 
  new IAuthProvider[] {
    new GoogleOAuth2Provider(appSettings),      //Sign-in with Goolge OAuth2        
    new LinkedInOAuth2Provider(appSettings),    //Sign-in with LinkedIn OAuth2        
}));

Note: OAuth2 requires the additional ServiceStack.Authentication.OAuth2 NuGet package and Web.Config settings, see Auth docs for more info.

Using Request Filters

You can also enforce specific requirements for client requests by a Global Request Filter or opt-in Request Filter Attributes, e.g:

this.RequestFilters.Add((httpReq, httpRes, requestDto) => {
    var authHeader = httpReq.Headers[HttpHeaders.Authorization];
    if (!IsValidAuthHeader(authHeader)) {
        httpRes.StatusCode = (int)HttpStatusCode.Unauthorized;
        httpRes.StatusDescription = "Authentication is required";
        httpRes.EndRequest();
    }
});

More Service Restrictions

Also related are the Security docs describes how you can declaratively restrict services using the [Restrict] attribute.