Calling [Auto Api] , response status code 302 , why not 401 ?

[yincen]

hi,
when i calling the [AUTO API] without login, why is the response status code 302 instead of 401.
version : 3.0.5
ui : MVC
In this case, I want the response to be 401.
how can i do ?
thank you !

[hikalkan]

Hi,

Can you write your method here? For example, I am getting 401 when I try this:

Also, how you are calling it? Using an external tool? Please write the steps to re-produce it.

[yincen]

Sorry, I just saw the message now.
I don't create controller, Just create a application service
You can re-produce it by following the steps below:

1. Create file "TestAppService" in application layer, Code:

namespace Acme.BookStore
{
    [Authorize]
    public class TestAppService : BookStoreAppService
    {
        public string GetName()
        {
            return "hihihi";
        }
    }
}

2. Calling the API by Swagger UI
   It redirected to the login page.
   

[maliming]

@yincen See #2643 (comment)

[hikalkan]

I am reponing this since I've got a similar comment: "If you hit an API endpoint that has an [Authorize] header as an anonymous user it responds with a 200 response and an html login page instead of a 401"

[mtozlu]

If your api call has X-Requested-With: XMLHttpRequest header, the api will return a 401 instead of redirecting to login page.
maliming's comment above has the explanation as to why this happens.
Nevertheless, if you are not able to add the header, here is a workaround you can use for now;

private void ConfigureRedirectStrategy(ServiceConfigurationContext context)
{
	// Without this, api calls without "X-Requested-With: XMLHttpRequest" 
	// are redirected to identity server login page.
	// We want to return 401:Unauthorized instead of redirecting
	context.Services.ConfigureApplicationCookie(options =>
		options.Events.OnRedirectToLogin = context =>
		{
			context.Response.Headers["Location"] = context.RedirectUri;
			context.Response.StatusCode = 401;
			return System.Threading.Tasks.Task.CompletedTask;
		});
}

Call it in your module's (I use it in HttpApiHostModule) ConfigureServices method.

[yincen]

If your api call has X-Requested-With: XMLHttpRequest header, the api will return a 401 instead of redirecting to login page.
maliming's comment above has the explanation as to why this happens.
Nevertheless, if you are not able to add the header, here is a workaround you can use for now;

private void ConfigureRedirectStrategy(ServiceConfigurationContext context)
{
	// Without this, api calls without "X-Requested-With: XMLHttpRequest" 
	// are redirected to identity server login page.
	// We want to return 401:Unauthorized instead of redirecting
	context.Services.ConfigureApplicationCookie(options =>
		options.Events.OnRedirectToLogin = context =>
		{
			context.Response.Headers["Location"] = context.RedirectUri;
			context.Response.StatusCode = 401;
			return System.Threading.Tasks.Task.CompletedTask;
		});
}

Call it in your module's (I use it in HttpApiHostModule) ConfigureServices method.

Thank you. This is what I want.

[maliming]

hi @mtozlu

For Angular you can try to configure the DefaultAuthenticateScheme and DefaultChallengeScheme .

services.AddAuthentication(options =>
{
      options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
      options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options => //......

[sebitsi]

Hi @hikalkan @maliming
What is status of this issue ?

@mtozlu post workaround. But this is only workaround.
And response body is still different than in native controller response.

Are you preparing some update to achieve same behavior when calling controller vs. dynamicaly created from appservice ?
When calling ABP API from outside world there shoudn't be difference if i made constroller or it has been created dynamicaly from appservice.

[maliming]

This is follows the AspNet Core design.

#2643 (comment)

[sebitsi]

@maliming Thanks for your answere.
I understand your comment.

But calling native controller or dynamicaly created should return same response. Right ?

{
  "error": {
    "code": "Volo.Authorization:010001",
    "message": "Authorization failed! Given policy has not granted.",
    "details": null,
    "data": {},
    "validationErrors": null
  }
}

Why you decided to return login page (redirection) ? What's the case ?

How i can extend workaround that return same response that native controller (error json) ?

[maliming]

#9940

[laosandegudai]

hi @mtozlu

For Angular you can try to configure the DefaultAuthenticateScheme and DefaultChallengeScheme .

services.AddAuthentication(options =>
{
      options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
      options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options => //......

This is very useful and I use it for CRUD App Service