Jwt

[aminebizid]

Any sample for how to pass a Auth token while connecting.

[moozzyk]

Can you pass it in the queryString?

I'd like to know, too :)

[davidfowl]

Yes, you can pass the JWT token in the query string and use the authentication handler events to get the token. Will try to put together a sample.

[damienbod]

Why would you pass the token in the querystring? This is unsecure. Auth tokens should only be passed in the header, the querystring is logged everywhere on the network.

[davidfowl]

@damienbod because thats' the only way to get it over the wire with websockets from javascript. Sending it over the websocket itself isn't using http, it's custom.

This problem isn't unique to SignalR see https://stackoverflow.com/questions/31680641/passing-jwt-to-node-js-websocket-in-authorization-header-on-initial-connection as an example.

[DamianEdwards]

Perhaps we need to attempt a sample of sending the token as part of a handshake over the websocket after connection, assuming the ASP.NET Core security bits are factored such that would even be possible right now (it might not be). This has been an issue forever.

[davidfowl]

I don't think we should, that would be adding authentication to our protocol. The ASP.NET authentication stack is very much tied to HTTP. The authorization stack isn't.

[DamianEdwards]

I meant a sample at the application level.

[aminebizid]

In previous release (SignalR 2 & Core 1.1), we used to make like this:

ng Client

const channelConfig = new ChannelConfig();
channelConfig.url = this.appConfig.config.signalRConfig.url;
channelConfig.hubName = this.appConfig.config.signalRConfig.hubName;
this.channelService.init(channelConfig);
this.channelService.start({user: this._adalService.userInfo.username, token: this._adalService.userInfo.token});

Middleware

public static void UseSignalRQSToken(this IApplicationBuilder app)
{
            app.Use(async (context, next) =>
            {
                var x = context.Request.Path.Value;
                if (x.StartsWith("/signalr/"))
                {
                    StringValues token;
                    if (context.Request.Query.TryGetValue("token", out token))
                    {
                        context.Request.Headers.Add("Authorization", new string[] { "bearer " + token });
                    }
                }

                await next();
            });

}

Hub

[Authorize]
[HubName("SignalRHub")]
public class SignalRHub : Hub
{
}

Is it possible to do the same with SignalR Core & core 2.0?

[willthiswork89]

any update on this? It would be great to be able to add JWT auth to connections. I suppose i could do this manually somehow but it would be great to get some built in support.

Actually it works just like @Zigzag95 said.

TS-Client (ng)

let url = hubUrl + "?token=" + access_token;           
this.httpCon = new HttpConnection(url, { transport: TransportType.WebSockets }); 
this.hubConnection = new HubConnection(this.httpCon);        
this.hubConnection.start().then((v) => { console.log("Connection Init complete!"); })
		.catch(err => console.error(err)));

Server middleware exactly like @Zigzag95 's. Just be sure to add app.UseSignalRQSToken() before app.UseAuthentication(); in startup.cs

[damienbod]

@Zigzag95 @MoxxNull Your sending your access_token in the querystring for everyone to copy paste. Your application is now unsecure.

@davidfowl @DamianEdwards You should not support this, a different way of securing SignalR should be considered, maybe one time tokens, but not access_tokens in the query string

[davidfowl]

@willthiswork89 what built in support are you expecting? There's nothing unique here really. There's nothing in our stack today that issues JWT tokens, so assuming you're using something like identity server to do that, the only question is about passing the token via the query string and then using the JWT Bearer authentication handler read the token from the query string instead of a header.

[davidfowl]

@damienbod there's nothing to not support. It won't be blocked.

@Zigzag95 @MoxxNull Your sending your access_token in the querystring for everyone to copy paste. Your application is now unsecure.

Copy and paste where? The main difference between the header and querystring is that some systems log query strings. If the access token expires and is revokable it's not as big a deal as you make it out to be, or am I missing something?

[DamianEdwards]

The debate over HTTPS URLs (including query strings) is long and on-going. Yes, it's not ideal to send sensitive data in the URL even when over HTTPS. But the fact remains that when using the browser WebSocket APIs there is no other way. You only have 3 options:

• Use cookies
• Send tokens in query string
• Send tokens over the WebSocket itself after onconnect

A usable sample of the last would be interesting in my mind, but I'm not expecting it to be trivial.