Hi,
I have endpoint returning product imag. End point interface has [ Authorize, AuthorizeScopes( 'myscopes' ) ]
I don’t wan’t it to be open to public but I need to expose that to clients which access it using token as query parameter.
I tried to use jWtMiddleware.OnForbidRequest to set ForBid :=false but it didn’t affect.
Is the any other way than declared other endpoint which requires token always?
Hi @Mika_Koistinen, it's not clear to me what you want to achieve?
If you want the endpoint to be protected and accessible only to authenticated requests (requests providing a token via Authorization header), then indeed you should use the Authorize (or any other Authorize*) attribute.
If you want the endpoint to be public and accessible for everyone, then remove the attributes.
You can also control that behavior using the OnForbidRequest event indeed. Setting to False makes it public, setting to True makes it protected by a token.
You said both things. What exactly do you want?
Hi @wlandgraf,
Case is this.
Third party service needs to access products pictures behind our Xdata server.
I have endpoint which returns products picture and I’m sending URLs to 3rd party service.
But issue is that this third party service doesn’t support authentication while retrieving pictures.
so I could add token to the URL and allow access if token is valid.
But without that token normal bearer authentication should work.
So
Either
get ../pictures/1221?token=123456789abcdegh
or
get ../pictures/1221
authorization: Bearer eyJxxxxx
But not total open.
I tried to use that OnForbidRequest, but it did’t work. I debugged and event was triggered and it set ForBid to false, but after exiting the JWTMiddleware unauthorized exception was raised.
These are my middlewares
Module.AddMiddleware( TJwtMiddleware.Create( fjwtsecret ) );
Module.AddMiddleware( TCorsMiddleware.Create );
Module.AddMiddleware( TForwardMiddleware.Create );
module.AddMiddleware( clm ); /// Content Logger middleware
module.AddMiddleware( TWebSocketMiddleware.Create );
I resolved this by making 2nd endpoint. But I’m interested why OnForbidRequest didnt have effect
Do I understand that you read a token directly from the URL in the OnForbidRequest event, and based on that you set it to False in JWT middleware?
If that's the case, it should work. Maybe send a small project reproducing the issue?
Other than this, the JWT middleware only accepts tokens in Authorization header, not in the query URL.