Subscription authorization

[coding4food]

Subscriptions implementation passes MessageHandlingContext instance as userContext argument down the processing pipeline, so graphql-dotnet/authorization does not work with subscriptions.

[joemcbride]

Known issue at this time. This is dependent on graphql-dotnet/graphql-dotnet#637 getting implemented.

[corstian]

Why is https://github.com/graphql-dotnet/server/blob/develop/samples/Samples.Server/AddAuthenticator.cs being commented out? While we're waiting this would be an excellent intermediate solution I think.

[johnrutherford]

PR #158 adds support for endpoint authorization that integrates with ASP.NET Core authentication and authorization policies.

If the "AddAuthenticator" approach works for you, then there's no reason not to use it for now.

[corstian]

Oh excellent! 😊 It unblocks me now so that's all good.

[klowdo]

I made this to work with websockets graphql-dotnet/authorization#19

[rose-a]

IMO it's important to not only think about authorizing subscriptions, but any GraphQL request which is passed via websocket (https://www.apollographql.com/docs/link/links/ws.html).

I built a working solution in the "AddAuthenticator" style using the pre-release from #208 which is meant to be authorization schema independent in that the whole content of the authorization header is passed in an authorization field and which then is run through the whole AuthenticationMiddleware:

/// <summary>
/// allows to pass the content of the HTTP Authorization header in a payload field 'authorization'
/// </summary>
public class AuthorizationListener: IOperationMessageListener
{
    private readonly IServiceProvider _serviceProvider;

    public AuthorizationListener(IServiceProvider serviceProvider)
    {
        _serviceProvider = serviceProvider;
    }

    /// <summary>
    /// reads the payload field 'authorization' if present and runs the content through the AuthenticationMiddleware
    /// </summary>
    /// <param name="context"></param>
    /// <returns></returns>
    public async Task BeforeHandleAsync(MessageHandlingContext context)
    {
        // try to parse token from payload and quit if none is present
        var authorization = (context.Message.Payload as JObject)?.Value<string>("authorization");
        if (string.IsNullOrEmpty(authorization))
            return;

        // create new scope to be able to run the authorization handler again which is otherwise prevented
        // by AuthenticationHandler.HandleAuthenticateOnceAsync()
        using (var serviceScope = _serviceProvider.CreateScope())
        {
            // create temporary context
            var httpContext = new DefaultHttpContext {RequestServices = serviceScope.ServiceProvider};

            // set the Authorization header of the context
            httpContext.Request.Headers["Authorization"] = authorization;

            // create and run AuthenticationMiddleware
            var authenticationMiddleware = new AuthenticationMiddleware(ctx =>
                {
                    context.Properties[MessageHandlingContextClaimsPrincipalAccessor.ClaimsPrincipalKey] =
                        ctx.User;
                    return Task.CompletedTask;
                },
                httpContext.RequestServices.GetService<IAuthenticationSchemeProvider>());
            await authenticationMiddleware.Invoke(httpContext).ConfigureAwait(false);
        }
    }

    public Task HandleAsync(MessageHandlingContext context)
    {
        return Task.CompletedTask;
    }

    public Task AfterHandleAsync(MessageHandlingContext context)
    {
        return Task.CompletedTask;
    }
}

[jonmill]

@rose-a - I'm attempting to use your above solution to authenticate WebSocket subscriptions and JWT tokens, but the GraphQL AuthorizeWith call doesn't seem to pick up on the authenticated client...any idea if your solution works with Subscriptions and JWTs?

[STRATZ-Ken]

Any word on if this still works? I get the user on context.Properties[MessageHandlingContextClaimsPrincipalAccessor.ClaimsPrincipalKey] = ctx.User;
But once I check inside the Subscribe Method, I dont see any properties or the user object.

[jonmill]

@STRATZ-Ken - I ended up rolling my own authentication for subscriptions and abandoning the approach taken here

[STRATZ-Ken]

I am about 10 hours, any desire to share? :) @jonmill

[jonmill]

Sure thing :). It took a bit of work on both the client and server side to get it to work nicely and only work with authenticated clients.

1. Setup JWT authentication as normal
2. Enable Websockets using the ASP Core Configure function (we use a different URL for subscriptions for other reasons, but you can remove /subscriptions to not override this.

app..UseWebSockets(new WebSocketOptions()
{
     KeepAliveInterval = TimeSpan.FromSeconds(20),
})
.UseGraphQLWebSockets<PlatformSchema>("/subscriptions")

3. In the Subscription implementation, we have an endpoint that the frontend calls to setup notifications from the server:

AddField(new EventStreamFieldType()
            {
                Name = "notifications",
                Type = typeof(NotificationBaseOutputType),
                Arguments = new QueryArguments() { new QueryArgument<NonNullGraphType<StringGraphType>>() { Name = "authToken" } },
                Resolver = new FuncFieldResolver<NotificationBase?>(ResolveNotificationForUser),
                Subscriber = new EventStreamResolver<NotificationBase>(SubscribeToNotificationsForUser),
            });

When callers use this endpoint, they pass the JWT as a normal GraphgQL argument in order for us to manually verify the JWT. Once the JWT is verified, we can create an Observable for notifications and add it to a runtime cache on the server. We create wrappers around the Observable to allow us to cleanup nicely when the Observable fires a Cancellation (ie when the TCP connection is closed).

Now we have the Websocket connection established, we verified the user auth, and we have the observable cached with the user credentials so we can push data down to them through the Observable.

The difficult part about Websocket Subscriptions is the lack of control the web side has; we found a way to not require passing the JWT manually and using cookie auth, but hit snags there. If you rely on Cookie JWT auth for Websocket Subscriptions, it appears that the javascript side cannot specify which cookie to use in the websocket and the browser takes whatever cookie is "first", so that led to issues in corporate environments where we can't control all the cookies. Instead of trying to find a way around that, we're just sticking to passing the JWT as an argument and having the frontend establish the connection that way

[STRATZ-Ken]

I saw an example of someone saying its just easier to require a user to send Bearer token as a param. Pretty much what you did as well.

Just got it working, though, I hope this isn't given up on in this project. Some extra JWT Handler code will bug me. :)

private async Task<IObservable<Object>> Subscribe(ResolveEventStreamContext context)
        {
            var bearer = context.GetArgument<string>("bearer");
            var user = ValidateBearer(bearer);
            var identity = user?.Identity?.GetUserGuid();
            if (!identity.HasValue)
            {
                context.Errors.Add(new GraphQL.ExecutionError($"Missing Bearer Token"));
                return new List<Object>().ToObservable();
            }

            return stuff....
        }


        // This Authentication below is only used for Subscriptions with GraphQL as its not yet supported. It mimics Startup.cs file in API.
        private ClaimsPrincipal ValidateBearer(string bearer)
        {
            return handler.ValidateToken(bearer, tokenParams, out SecurityToken token);
        }

        JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
        private static byte[] key = System.Text.Encoding.ASCII.GetBytes(ConfigurationRepository.Configuration["APIJWTSecurityKey"]);
        private TokenValidationParameters tokenParams = new TokenValidationParameters
        {
            ValidIssuer = ConfigurationRepository.Configuration["TokenIssuer"], 
            ValidateAudience = false,
            IssuerSigningKey = new SymmetricSecurityKey(key) 
        };