Let me seperate up everything and solve approach each problem in isolation: Authentication For authentication, baseauth has the advantage that it is a mature solution on the protocol level. This means a lot of “might crop up later” problems are already solved for you. For example, with BaseAuth, user agents know the password is a … Read more
I wanted to set a bounty on my question, but I have succeeded in creating solution. My problem seemed to be connected with incorrect value of secret key (it must be correct parameter for base64.b32decode() function). Below I post full working solution with explanation on how to use it. Code The following code is enough. … Read more
First off. 401 is the proper response code to send when a failed login has happened. 401 Unauthorized Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided. The response must include a WWW-Authenticate header field containing a challenge applicable to the requested resource. … Read more
Try this: [Authorize] public ActionResult SomeAction() { var identity = (ClaimsIdentity)User.Identity; IEnumerable<Claim> claims = identity.Claims; … }
Use connect-redis and have redis as your session store for all authenticated users. Make sure on authentication you send the key (normally req.sessionID) to the client. Have the client store this key in a cookie. On socket connect (or anytime later) fetch this key from the cookie and send it back to the server. Fetch … Read more
OpenID is a way to specify one identity for multiple sites so you don’t need to register over and over again. OAuth is a way to allow one application access to one account without giving said application your account login information. You can use them in conjunction. More info: OAuth-OpenID: You’re Barking Up the Wrong … Read more
Neither. You should use bcrypt. The hashes you mention are all optimized to be quick and easy on hardware, and so cracking them share the same qualities. If you have no other choice, at least be sure to use a long salt and re-hash multiple times. Using bcrypt in PHP 5.5+ PHP 5.5 offers new … Read more
I found some information about CSRF + using no cookies for authentication: https://auth0.com/blog/2014/01/07/angularjs-authentication-with-cookies-vs-token/ “since you are not relying on cookies, you don’t need to protect against cross site requests” http://angular-tips.com/blog/2014/05/json-web-tokens-introduction/ “If we go down the cookies way, you really need to do CSRF to avoid cross site requests. That is something we can forget when … Read more
Try setting (in global.cs): AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;
Here’s an updated example using Angular 4 (also compatible with Angular 5 – 8) Routes with home route protected by AuthGuard import { Routes, RouterModule } from ‘@angular/router’; import { LoginComponent } from ‘./login/index’; import { HomeComponent } from ‘./home/index’; import { AuthGuard } from ‘./_guards/index’; const appRoutes: Routes = [ { path: ‘login’, component: … Read more