persistent-connection-authorization.md

uid	title	author	description	ms.author	ms.date	ms.assetid	msc.legacyurl	msc.type
signalr/overview/older-versions/persistent-connection-authorization	Authentication and Authorization for SignalR Persistent Connections (SignalR 1.x) | Microsoft Docs	bradygaster	This topic describes how to enforce authorization on a persistent connection. For general information about integrating security into a SignalR application,...	bradyg	10/21/2013	c34bc627-41af-4c21-a817-e97a19a7f252	/signalr/overview/older-versions/persistent-connection-authorization	authoredcontent

Authentication and Authorization for SignalR Persistent Connections (SignalR 1.x)

by Patrick Fletcher, Tom FitzMacken

[!INCLUDE Consider ASP.NET Core SignalR]

This topic describes how to enforce authorization on a persistent connection. For general information about integrating security into a SignalR application, see Introduction to Security.

Enforce authorization

To enforce authorization rules when using a PersistentConnection you must override the AuthorizeRequest method. You cannot use the Authorize attribute with persistent connections. The AuthorizeRequest method is called by the SignalR Framework before every request to verify that the user is authorized to perform the requested action. The AuthorizeRequest method is not called from the client; instead, you authenticate the user through your application's standard authentication mechanism.

The example below shows how to limit requests to authenticated users.

[!code-csharpMain]

You can add any customized authorization logic in the AuthorizeRequest method; such as, checking whether a user belongs to a particular role.