Serve static files behind Google authentication

Question

I want to make a static generated site using Gatsby. This is all fine, but I want to have authentication and authorization in place, as this is an internal site - it should only be accessed by people in my company. I thought about this, and without some server component, it's impossible (?) to securely authenticate users without some kind of backend. I thought I could use ASP.NET Core to serve static files and have Google (for Work) authentication and authorization in front of these static files.

It seems like the StaticFileHandler doesn't support authorization by design, as it is only responsible for serving static files which are publicly accessible. I managed to get Google authentication working by using the Authorize attribute on my root action (which listens to '/'), and having login actions which issued a Challenge and the user would be redirected to Google for authentication. Further reading in the documentation for handling static files says:

The static file module provides no authorization checks. Any files served by it, including those under wwwroot are publicly available. To serve files based on authorization:

Store them outside of wwwroot and any directory accessible to the static file middleware and

Serve them through a controller action, returning a FileResult where authorization is applied

So now I have an Index action on my HomeController which looks like this:

[Authorize]
public IActionResult Index()
{
    // TODO: Return static files based on incoming requested path.
    return View();
}

I'm not very happy with this solution. Should I make the whole thing work with middleware instead of using MVC? Is this even the right way to do this? Are there any better ways of doing this?

chmac chmac · Accepted Answer · 2018-02-19T15:24:55

Gatsby will produce a folder of static content, which does not have any concept of authorisation.

I'd suggest you need to handle authentication at a different layer. For example, you could add a simple Basic authorisation header requirement at the webserver layer. This would be trivial in nginx or apache.

Building authentication into your Gatsby project would either defeat the purpose of a static site, or mean that your content is publicly accessible as JSON files, but your React application will refuse to load it unless some authorisation requirement has been met (insecure).

Serve static files behind Google authentication

2 Answers