Question

I’ve got an issue with the BasicAuthProvider in ServiceStack. POST-ing to the CredentialsAuthProvider (/auth/credentials) is working fine.

The problem is that when GET-ing (in Chrome):
http://foo:pwd@localhost:81/tag/string/list

the following is the result

Handler for Request not found:

Request.HttpMethod: GET
Request.HttpMethod: GET
Request.PathInfo: /login
Request.QueryString: System.Collections.Specialized.NameValueCollection
Request.RawUrl: /login?redirect=http%3a%2f%2flocalhost%3a81%2ftag%2fstring%2flist

which tells me that it redirected me to /login instead of serving the /tag/… request.

Here’s the entire code for my AppHost:

public class AppHost : AppHostHttpListenerBase, IMessageSubscriber
{
    private ITagProvider myTagProvider;
    private IMessageSender mySender;

    private const string UserName = "foo";
    private const string Password = "pwd";

    public AppHost( TagConfig config, IMessageSender sender )
        : base( "BM App Host", typeof( AppHost ).Assembly )
    {
        myTagProvider = new TagProvider( config );
        mySender = sender;
    }

    public class CustomUserSession : AuthUserSession
    {
        public override void OnAuthenticated( IServiceBase authService, IAuthSession session, IOAuthTokens tokens, System.Collections.Generic.Dictionary<string, string> authInfo )
        {
            authService.RequestContext.Get<IHttpRequest>().SaveSession( session );
        }
    }

    public override void Configure( Funq.Container container )
    {
        Plugins.Add( new MetadataFeature() );

        container.Register<BeyondMeasure.WebAPI.Services.Tags.ITagProvider>( myTagProvider );
        container.Register<IMessageSender>( mySender );

        Plugins.Add( new AuthFeature( () => new CustomUserSession(),
                new AuthProvider[] {
                    new CredentialsAuthProvider(), //HTML Form post of UserName/Password credentials
                    new BasicAuthProvider(), //Sign-in with Basic Auth
                } ) );

        container.Register<ICacheClient>( new MemoryCacheClient() );
        var userRep = new InMemoryAuthRepository();
        container.Register<IUserAuthRepository>( userRep );

        string hash;
        string salt;
        new SaltedHash().GetHashAndSaltString( Password, out hash, out salt );
        // Create test user
        userRep.CreateUserAuth( new UserAuth
        {
            Id = 1,
            DisplayName = "DisplayName",
            Email = "[e-mail]",
            UserName = UserName,
            FirstName = "FirstName",
            LastName = "LastName",
            PasswordHash = hash,
            Salt = salt,
        }, Password );
    }
}

Could someone please tell me what I’m doing wrong with either the SS configuration or how I am calling the service, i.e. why does it not accept the supplied user/pwd?

Update1: Request/Response captured in Fiddler2when only BasicAuthProvider is used.
No Auth header sent in the request, but also no Auth header in the response.

GET /tag/string/AAA HTTP/1.1
Host: localhost:81
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko)        Chrome/23.0.1271.64 Safari/537.11
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,sv;q=0.6
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ss-pid=Hu2zuD/T8USgvC8FinMC9Q==; X-UAId=1; ss-id=1HTqSQI9IUqRAGxM8vKlPA==

HTTP/1.1 302 Found
Location: /login?redirect=http%3a%2f%2flocalhost%3a81%2ftag%2fstring%2fAAA
Server: Microsoft-HTTPAPI/2.0
X-Powered-By: ServiceStack/3,926 Win32NT/.NET
Date: Sat, 10 Nov 2012 22:41:51 GMT
Content-Length: 0

Update2 Request/Response with HtmlRedirect = null . SS now answers with the Auth header, which Chrome then issues a second request for and authentication succeeds

GET http://localhost:81/tag/string/Abc HTTP/1.1
Host: localhost:81
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,sv;q=0.6
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ss-pid=Hu2zuD/T8USgvC8FinMC9Q==; X-UAId=1; ss-id=1HTqSQI9IUqRAGxM8vKlPA==

HTTP/1.1 401 Unauthorized
Transfer-Encoding: chunked
Server: Microsoft-HTTPAPI/2.0
X-Powered-By: ServiceStack/3,926 Win32NT/.NET
WWW-Authenticate: basic realm="/auth/basic"
Date: Sat, 10 Nov 2012 22:49:19 GMT

0

GET http://localhost:81/tag/string/Abc HTTP/1.1
Host: localhost:81
Connection: keep-alive
Authorization: Basic Zm9vOnB3ZA==
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,sv;q=0.6
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ss-pid=Hu2zuD/T8USgvC8FinMC9Q==; X-UAId=1; ss-id=1HTqSQI9IUqRAGxM8vKlPA==

Answer 1

Prefixing foo:pwd@ to a url like:

http://foo:pwd@localhost:81/tag/string/list

is not how you do BasicAuth with HTTP, the wikipedia page for an example:

Sending BasicAuth request with a HTTP client

When the user agent wants to send the server authentication credentials it may use the Authorization header.

The Authorization header is constructed as follows:

1. Username and password are combined into a string “username:password”
2. The resulting string literal is then encoded using Base64
3. The Authorization method and a space i.e. “Basic “ is then put before the encoded string.

For example, if the user agent uses ‘Aladin’ as the username and ‘sesam open’ as the password then the header is formed as follows:

Authorization: Basic QWxhZGluOnNlc2FtIG9wZW4=