how to redirect UI application to access denied on every type of request in .net core

Question

User-171003712 posted

I have two application one is API and one is UI, in api some methods or permission based return as per below code

if (!await _permissionMasterServcie.Authorize(StandardPermissionProvider.Category, PermissionType.View).ConfigureAwait(false))
        {
            return AccessDenied();
        }

then this consume in UI .net core application. In this application some method is call by jQuery or Kendoui grid, some MVC so when UI .net core application consume API its got status code "401 Unauthorized" so can we redirect every request in UI application to access denied page when status code received "401 Unauthorized". By any attribute or any configuration in startup file. I didn't get how to do that.

UI .net core application consuming api

public virtual async Task<IRestResponse> PostAsync(string request, string endPoint, string action, string token)
    {
        string url = endPoint + action;
        _restClient.BaseUrl = new Uri(url);
        _restRequest.Method = Method.POST;
        _restRequest.Timeout = 900000;
        _restRequest.Parameters.Clear();
        _restRequest.AddHeader("Authorization", token);
        _restRequest.AddParameter("application/json", request, ParameterType.RequestBody);
        IRestResponse response = await _restClient.ExecuteAsync(_restRequest, Method.POST);
        return response;
    }

here I'm getting response and status code both, here can we redirect every request to access denied for 401 code

Answer 1

User475983607 posted

I assume the client UI should detect the 401 and redirect.  If the UI is a browser based application use the built-in cookie authentication API.  If the UI is code like JavaScript/jQuery or an SPA then design a JWT solution.  JWT is also a built-in library. Lastly, there's Core Identity.

Answer 2

User-474980206 posted

in the UI project, just add middleware that checks for the 401 response and dos the redirect.

....  

  public async Task InvokeAsync(HttpContext context)
  {
            await _next(context);

            // check for 401 & redirect to login
            if (context.Response.StatusCode == 401)
            {
                 var url = AbsoluteUrl(context.Request);
                 var redirectUrl = _config.LoginUrl + "?returnUrl=" + WebUtility.UrlEncode(url);

                  context.Response.Redirect(redirectUrl);
            }
  }

  private string AbsoluteUrl(HttpRequest request)
  {
            return string.Concat(
                request.Scheme,
                "://",
                request.Host.ToUriComponent(),
                request.PathBase.ToUriComponent(),
                request.Path.ToUriComponent(),
                request.QueryString.ToUriComponent()
            );
  }

Answer 3

User-171003712 posted

I assume the client UI should detect the 401 and redirect.  If the UI is a browser based application use the built-in cookie authentication API.  If the UI is code like JavaScript/jQuery or an SPA then design a JWT solution.  JWT is also a built-in library. Lastly, there's Core Identity.

UI application is browser based and hosted to another server and consuming api from another server based on JWT. Ui application is in .net core.

Iam using RestSharp to consuming api and getting 401 and 200 status but i didn't get  understand to redirect by middleware or filter.

I dont want to check every method response code of api response.

Thanks

Answer 4

User-171003712 posted

Dear Bruce,

This is not working i have tried this before and same your code also. This will not work because we are check UI application context which is not connect api so this is not working in this case.

i want to understand if we connect through RestSharp or httpclinet then its going to through application so that pipeline we can add filter.

Thanks

Answer 5

User-474980206 posted

if you want the UI website to redirect when a network request return 401, then wrap the network calls so that they all show a common error in this case. then just use standard error handling to redirect:

  https://docs.microsoft.com/en-us/aspnet/core/fundamentals/error-handling?view=aspnetcore-3.1

Answer 6

User-171003712 posted

I have created one middleware with my API Call service inject but middleware execute first then methods so i cant check response of network call response in middleware.

public class APIMiddleware
    {
        private readonly RequestDelegate _next;
        private readonly APIMiddlewareOptions _options;

        public APIMiddleware(RequestDelegate next)
        {
            _next = next;

        }

        public async Task Invoke(HttpContext httpContext, IApiClient apiClient)
        {

           
            if (apiClient.httpStatusCode == System.Net.HttpStatusCode.Unauthorized)
            {
                var url = AbsoluteUrl(httpContext.Request);
                var redirectUrl = "/AccessDenied/Index";
                httpContext.Response.Redirect(redirectUrl);
            }
            await _next(httpContext);


        }
        private string AbsoluteUrl(HttpRequest request)
        {
            return string.Concat(
                request.Scheme,
                "://",
                request.Host.ToUriComponent(),
                request.PathBase.ToUriComponent(),
                request.Path.ToUriComponent(),
                request.QueryString.ToUriComponent()
            );
        }
    }

    // Extension method used to add the middleware to the HTTP request pipeline.
    public static class APIMiddlewareExtensions
    {
        public static IApplicationBuilder UseAPIMiddleware(this IApplicationBuilder builder)
        {
            return builder.UseMiddleware<APIMiddleware>();
        }
    }

in Startup.cs

   app.UseMiddleware<APIMiddleware>();