troubleshooting Question

Response.Redirect with Headers in .Net Core

Avatar of Kyle Abrahams
Kyle AbrahamsFlag for United States of America asked on
ASP.NET.NET Programming* JWTC#* .net core
16 Comments1 Solution305 ViewsLast Modified:
Hi All,

Trying to bring this authorization workflow together.

Essentially I have a protected service that requires a JWT bearer token.
I have an authorization service that generates a JWT bearer token.

In My Startup for the protect service:

        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
         app.UseStatusCodePages(async context =>
            {
                var request = context.HttpContext.Request;
                var response = context.HttpContext.Response;
                var path = request.Path.Value ?? "";

                if ( 
                        (response.StatusCode == (int)HttpStatusCode.Unauthorized || response.StatusCode == (int)HttpStatusCode.Forbidden)
                    && !request.Headers.ContainsKey("Authorization")
                   )
                {
                    var redirect = context.HttpContext.AbsoluteURL();
                    response.Redirect(config["JWT:AuthorizationServiceRedirect"] + config["AppID"] + "?redirectTo=" + redirect);
                }
            });
}

Open in new window


Essentially what this does it redirects to the Authorization service if the response fails.  No issues no problems there.

My authorization service also generates the JWT token. Part of that controller's code is:



            string redirect = HttpContext.Request.Query["redirectTo"].ToString();

            if (!String.IsNullOrEmpty(redirect))
            {
                Response.Headers.Add("Authorization", "Bearer " + dto.user.token);
                Response.Redirect(redirect);
            }

Which brings it back to my protected service.  In theory this Response should now contain the bearer token, however the protected service not letting it thru.  Upon inspecting the headers I don't see anything there.  From my research the headers aren't passed along on the redirect, so what's best practice on getting this to work and are there any security issues with the above?
ASKER CERTIFIED SOLUTION
Kyle Abrahams
Director of Information Technology

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Log in to continue reading
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform for $9.99/mo
View membership options
Unlock 1 Answer and 16 Comments.
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
The Value of Experts Exchange in My Daily IT Life

Experts Exchange (EE) has become my company's go-to resource to get answers. I've used EE to make decisions, solve problems and even save customers. OutagesIO has been a challenging project and... Keep reading >>

Mike

Owner of Outages.IO
Phoenix, Arizona, United States
Member Since 2016
Join a full scale community that combines the best parts of other tools into one platform.
Unlock 1 Answer and 16 Comments.
View membership options
“All of life is about relationships, and EE has made a virtual community a real community. It lifts everyone's boat.”
William Peck

Member since 2004