Hi. I have an existing Laravel application that I would

Question

Hi. I have an existing Laravel application that I would

like to eventually migrate to ASP.NET, but there are a few things holding me back.

My application consists of an API and a website, and Laravel handles authentication for me such that when I'm logged in, I can make authenticated requests to the API from the website, without going through the API authentication process.

Can Identity or any other existing package so this for me? If not, can this be implemented as middleware?

Here is a link to the relevant doc: https://laravel.com/docs/8.x/sanctum#spa-authentication

0

09.04.2021

11 ответов

7 просмотров

pete Автор вопроса

TLDR: I'd like a way to share authentication between a razor pages website and an API within the same app such that I don't need to worry about tokens when calling the API from the website.

0

09.04.2021

pete Автор вопроса

A X
Cookies do that and there are simple ways to set i...

I'd like the API to check cookies only for particular frontend domains, otherwise it should use tokens (for apps and non-whitelisted websites)

0

09.04.2021

A X

pete
I'd like the API to check cookies only for particu...

You just decorate your controllers with Authorize attribute and the authentication check happens as part of a middleware that comes with ASP.NET Core and such.

0

09.04.2021

pete Автор вопроса

A X

You just decorate your controllers with Authorize ...

I see. Thank you. I'll get started on a sample and let you know how it goes.

0

09.04.2021

A X

pete
I see. Thank you. I'll get started on a sample and...

Sure. Good luck.

0

09.04.2021

A X

You just decorate your controllers with Authorize ...

Role based Authorization also exists. Just a simple attribute declaration over api methods there too.

0

09.04.2021

pete Автор вопроса

A X
Role based Authorization also exists. Just a simpl...

I'll be sure to look into this as well.

0

09.04.2021

pete Автор вопроса

A X
Sure. Good luck.

It seems like the webapp scenario comes with batteries included but if I want JWT authentication I still have to do it myself. I've written middleware before to do JWT Auth for a simple Blazor PWA I had built as a demo. How could I wire this up such that asp.net falls back on jwt auth if: 1. The request is not from a whitelisted domain. 2. The request is from a whitelisted domain but does not contain a valid cookie.

0

13.04.2021

A X

pete
It seems like the webapp scenario comes with batte...

Even JWT stuff comes batteries included.

0

14.04.2021

A X

pete
It seems like the webapp scenario comes with batte...

I do not know whether that fallback is allowed. I have successfully setup projects with one or the other but never mixed them.

0

14.04.2021