Building a reusable microservice platform about microservices-in-dotnetcore HOT 2 CLOSED

I think the problem stems from requests that do not have the appropriate auth headers set.
In the Startup of HelloMicroservicesPlatform this code appears:

      app.UseOwin()
         .UseMonitoringAndLogging(ConfigureLogger(), HealthCheck)
         .UseAuthPlatform("test-scope")
         .UseNancy();

The important bit here is the UseAuthPlatform("test-scope") line which configures the auth middleware to require all requests to have an auth header and have the scope test-scope.
Unfortunately the auth middleware throws when there is no auth header instead of failing the request in a controlled manner. The bug is in line 18 of AuthorizationMiddleware.cs, which looks like this:

        if (principal.HasClaim("scope", requiredScope))

When there is no auth header principal is null. Boom.
To fix it change that line to

        if (principal != null && principal.HasClaim("scope", requiredScope))

Now you should get a proper 403 response when there are no auth headers.

Also worth noting is that the sample code in chapter 11 takes some fiddling to run because of the requirement for auth headers. -It's really more of an illustration than a ready to run solution.
You might consider taking out the auth platform bit and then see the other parts of the platform in action - that is the request logging, performance logging and monitor endpoints.

from microservices-in-dotnetcore.

Thanks for the update. Do you have an example request including auth headers and scope that we can try?

from microservices-in-dotnetcore.