HttpContext null from injected IHttpContextAccessor

[GarageWeb]

I have an authorization handler that I am injecting a custom personService into. I have wired up both the handler and the personService through the default DI. The person service IhttpContextAccessor works fine elsewhere in my application, but when it is called from the authorization handler, httpcontext is always null.

Here is the AuthHandler:

public class NoChildrenRequirement : AuthorizationHandler<NoChildrenRequirement>, IAuthorizationRequirement
{
    private readonly IPersonService _personService;

    public NoChildrenRequirement(IPersonService personService)
    {
        _personService = personService;
    }

    protected override void Handle(AuthorizationContext context, NoChildrenRequirement requirement)
    {
        var user = context.User;
        var identity = user.Identity;
        var isAuthenticated = identity.IsAuthenticated;

        var currentPerson = _personService.CurrentPerson();

        if (isAuthenticated && currentPerson != null && !currentPerson.IsAChild)
        {
            context.Succeed(requirement);
            return;
        }
        context.Fail();
    }
}

Here is where I wire it up in startup:

     services.AddTransient<NoChildrenRequirement>();
        services.Configure<AuthorizationOptions>(options =>
        {
            options.AddPolicy("NoChildren", policy => policy.Requirements.Add(
                services.BuildServiceProvider().GetRequiredService<NoChildrenRequirement>()));
        });

Here is the start of the personservice:

     public class PersonService : IPersonService
{
    private readonly IPersonRepository _repository;
    private readonly IMemoryCache _memoryCache;
    private readonly IConfigService _configService;
    private readonly IHttpContextAccessor _context;
    private readonly IResourceService _resourceService;
    private readonly string _cacheKey = "Person_";

    public PersonService(IPersonRepository repository, IMemoryCache memoryCache, 
        IConfigService configService, IHttpContextAccessor context, 
        IResourceService resourceService)
    {
        _repository = repository;
        _memoryCache = memoryCache;
        _configService = configService;
        _context = context;
        _resourceService = resourceService;
    }

Here is where I wire up person service in startup:

    services.AddTransient<IPersonService, PersonService>();

If I access : IHttpContextAccessor _context; in person service anywhere else in the application, it works, when I call personservice from the authhandler, all of the other dependencies wire up correctly and even the concrete HttpContextAccessor value is not null, but HttpContext within HttpContextAccessor is null.

v1.0.0-rc1-final

[davidfowl]

 services.AddTransient<NoChildrenRequirement>();
        services.Configure<AuthorizationOptions>(options =>
        {
            options.AddPolicy("NoChildren", policy => policy.Requirements.Add(
                services.BuildServiceProvider().GetRequiredService<NoChildrenRequirement>()));
        });

This isn't right. You should not be building another service provider and calling GetRequiredService<T> within configure services itself. What you're effectively doing is building 2 service providers, one that ASP.NET is actually using, and the other which only your NoChildrenRequirement uses. That's why you're seeing this behavior.

You should split the handler and the requirement, they need not be the same class. There are some great examples here by @blowdart (https://github.com/blowdart/aspnetauthorizationworkshop).

public class NoChildrenHandler : AuthorizationHandler<NoChildrenRequirement>
{
    private readonly IPersonService _personService;

    public NoChildrenHandler(IPersonService personService)
    {
        _personService = personService;
    }

    protected override void Handle(AuthorizationContext context, NoChildrenRequirement requirement)
    {
        var user = context.User;
        var identity = user.Identity;
        var isAuthenticated = identity.IsAuthenticated;

        var currentPerson = _personService.CurrentPerson();

        if (isAuthenticated && currentPerson != null && !currentPerson.IsAChild)
        {
            context.Succeed(requirement);
            return;
        }
        context.Fail();
    }
}

public class NoChildrenRequirement : IAuthorizationRequirement
{
}

services.AddSingleton<IAuthorizationHandler, NoChildrenHandler>();
services.Configure<AuthorizationOptions>(options =>
{
    options.AddPolicy("NoChildren", policy => policy.Requirements.Add(new NoChildrenRequirement()));
});

PS: The naming is a bit odd once the 2 are split. The requirement could probably renamed to something a bit more abstract like EntryRequirement (I'm bad at naming 😄 )

[GarageWeb]

Thanks, I will give this a try. I appreciate the help.

[GarageWeb]

OK, I gave this a shot, but Handle never gets called. It does hit the constructor, but never calls Handle. I made sure that I have no other attributes on the action. The Action just returns a view and I Added the attribute: [Authorize(Policy = "NoChildren")]. I will see if I can figure it out, but it appears to just hit the constructor and not Handle. On the plus side as person service is set in the constructor, it looks like HttpContext is not null now.

[davidfowl]

Change this line in Startup.ConfigureServices:

From

services.Configure<AuthorizationOptions>(options =>
{
    options.AddPolicy("NoChildren", policy => policy.Requirements.Add(new NoChildrenRequirement()));
});

services.AddAuthorization(options =>
{
    options.AddPolicy("NoChildren", policy => policy.Requirements.Add(new NoChildrenRequirement()));
});

[GarageWeb]

Thanks. Unfortunately this has the same behavior. It calls the constructor and never hits Handle.

[GarageWeb]

OK, I got it figured out. It only runs the handle method if logged in and of course I was using a test method outside of the login framework. As a part of the test method, I signed in and it worked. Thanks for your help.