Authentication in OnPrepareResponse

[audacity76]

Hi,

I want some of my static files only accessible when I'm authenticated/logged in. Unfortunately, the user's identity inside the HttpContext of the StaticFileResponseContext isn't filled. Is there a way to enable the authentication?

[Tratcher]

OnPrepareResponse is not a good place to perform authorization. This event only lets you tweak the response before sending it, you cannot prevent the response (except by throwing).

Issue tracking this feature: #70

The best way to handle this right now is to move to an MVC controller that matches your path, checks Authorization, and sends the file. @blowdart do you have a ready example for this?

[muratg]

Closing, dup of #70

[blowdart]

Nope, it'd just be returning a FileStreamResult with the appropriate mime type though.

[audacity76]

@blowdart

Is it a bad idea to just check if the identity cookie is set? Like

OnPrepareResponse = (x) =>
{
  if (!x.Context.Request.Cookies.ContainsKey(".AspNetCore.Identity.Application"))
    x.Context.Response.StatusCode = StatusCodes.Status401Unauthorized;
}

[Tratcher]

You can't do authorization here, the file is still sent, just with a 401 status code.

[blowdart]

And that doesn't check anything except that a cookie, any cookie has the right name. You can't do what you want using the static files middleware.

[audacity76]

Last try guys...

@Tratcher
Resetting Response Body and ContentLength = 0 prevents sending the file.

@blowdart
Sure, it is only checking for the cookie existence. Is there no easy way to perform a check with identity framework with the given cookies to authenticate the user?

[blowdart]

Honestly this isn't what static files is meant for. I wouldn't try to push auth into it, you're venturing far into unsupported territory and doing that when you want security is a bad idea, and will make kittens cry.

[Tratcher]

I'll write a proper Authorized MVC Controller sample for static files when I get a chance.

[Tratcher]

It will be easier to emulate the static file middleware features in MVC after aspnet/Mvc#6150

[lumogox]

@Tratcher Do you have an example of this?

I'll write a proper Authorized MVC Controller sample for static files when I get a chance.

[Tratcher]

@lumogox no, I should do that... Filed aspnet/AuthSamples#28.

[lumogox]

@Tratcher Great!, let me know if you have a quick example that I can look. Thanks!

[Tratcher]

I'm sorry I ever recommended using MVC for this, it is not a good fit. See dotnet/aspnetcore#2457 (comment) for discussion and an alternate sample using middleware and pipeline branching.