User373134933 posted
My web application uses cookie authentication. The user can sign in and remains authenticated until they sign out or cookies are deleted.
For automation purposes, I need to create a way to let the user sign in for a single request via an access token in the URL. Now I'm at the point where I need to do something when I see this token. I don't want to set any cookies, but still have all the
claims around that are normally there as the rest of the application relies on them.
I normally do something like this:
var claims = new List<Claim>
{
new Claim("UserId", user.Id.ToString()),
new Claim(ClaimTypes.Name, user.LoginName)
};
var claimsIdentity = new ClaimsIdentity(
claims,
CookieAuthenticationDefaults.AuthenticationScheme);
await HttpContext.SignInAsync(
CookieAuthenticationDefaults.AuthenticationScheme,
new ClaimsPrincipal(claimsIdentity),
new AuthenticationProperties
{
IsPersistent = true
});
Now I tried that:
var claims = new List<Claim>
{
new Claim("UserId", user.Id.ToString()),
new Claim(ClaimTypes.Name, user.LoginName)
};
var claimsIdentity = new ClaimsIdentity(claims);
await context.HttpContext.SignInAsync(new ClaimsPrincipal(claimsIdentity));
But it doesn't work. HttpContext.User.Identity.IsAuthenticated returns false and HttpContext.User.Claims is empty. This would normally be different.
What can I do to achieve this per-request authentication?
