Skip to main content

OWIN, OAuth - Bearer tokens: Authentication and Authorization for unit tests

It is a fact that nowadays, SPA applications are used in almost all new web project. In general behind a SPA application we have multiple REST endpoints that are used to get data, execute different actions and many more.
Token base authentication is worldwide use when we need to secure a REST endpoint and offer a mechanism for authentication and authorization.
In general when we create a SPA application using AngularJS we will use token based authentication. This mean that we will have an endpoint called ‘token’ (or other path) where users can send their username and password and receive a token that can be used to access different resources. Once we have the token, we will set the bearer token value of the authorization heather.

Beside this we need to be able to write unit tests or integration tests that hit our REST services and validate their functionality. For this purpose we need to have a code that simulates the authentication step and inject in the REST request the bearer token.
Below you can find the C# code that can be used for this purpose. In constructor, the REST endpoint is called and access token is created. Once this step is done, the "SetAuthorizationToken" can be called to set the authorization token on http client.
public class AuthorizationHelper
{                        
    private string accessToken;

    public AuthorizationHelper(string serverUrl, string username, string password)
    {
        ResolveBearerToken(username, password, serverUrl);
    }

    private void ResolveBearerToken(string username, string password, string serverUrl)
    {
        using (HttpClient httpClient = new HttpClient())
        {
            httpClient.BaseAddress = new Uri(serverUrl);
            SetHeatherInformation(httpClient);

            // Have to
            StringContent content = new StringContent(
                                            string.Format("grant_type=password&username={0}&password={1}", username, password),
                                            Encoding.UTF8, 
                                            "application/x-www-form-urlencoded");
            Task<HttpResponseMessage> responseTask = httpClient.PostAsync("token", content);
            responseTask.Wait();
            HttpResponseMessage response = responseTask.Result;

            if (response.StatusCode != HttpStatusCode.OK)
            {
                throw new Exception(string.Format("Auth failed for user '{0}' with status code '{1}'", username,
                    response.StatusCode));
            }

            Task<object> readResponseTask = response.Content.ReadAsAsync<object>();
            readResponseTask.Wait();
            dynamic responseContent = readResponseTask.Result;
            accessToken = responseContent.access_token;

            if (accessToken == null)
            {
                throw new Exception("Auth token is null.");
            }
        }
    }

    private static void SetHeatherInformation(HttpClient httpClient)
    {
        httpClient.DefaultRequestHeaders.UserAgent.ParseAdd(@"Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.91 Safari/537.36");
        httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(@"text/plain"));
        httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(@"*/*"));            
        httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/x-www-form-urlencoded"));
    }

    public void SetAuthorizationToken(HttpClient httpClient)
    {
        httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
    }
}

Enjoy!

Comments

Popular posts from this blog

ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded

Today blog post will be started with the following error when running DB tests on the CI machine:
threw exception: System.InvalidOperationException: The Entity Framework provider type 'System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer' registered in the application config file for the ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded. Make sure that the assembly-qualified name is used and that the assembly is available to the running application. See http://go.microsoft.com/fwlink/?LinkId=260882 for more information. at System.Data.Entity.Infrastructure.DependencyResolution.ProviderServicesFactory.GetInstance(String providerTypeName, String providerInvariantName) This error happened only on the Continuous Integration machine. On the devs machines, everything has fine. The classic problem – on my machine it’s working. The CI has the following configuration:

TeamCity.NET 4.51EF 6.0.2VS2013
It seems that there …

How to check in AngularJS if a service was register or not

There are cases when you need to check in a service or a controller was register in AngularJS.
For example a valid use case is when you have the same implementation running on multiple application. In this case, you may want to intercept the HTTP provider and add a custom step there. This step don’t needs to run on all the application, only in the one where the service exist and register.
A solution for this case would be to have a flag in the configuration that specify this. In the core you would have an IF that would check the value of this flag.
Another solution is to check if a specific service was register in AngularJS or not. If the service was register that you would execute your own logic.
To check if a service was register or not in AngularJS container you need to call the ‘has’ method of ‘inhector’. It will return TRUE if the service was register.
if ($injector.has('httpInterceptorService')) { $httpProvider.interceptors.push('httpInterceptorService&#…

Fundamental Books of a Software Engineer (version 2018)

More then six years ago I wrote a blog post about fundamental books that any software engineer (developer) should read. Now it is an excellent time to update this list with new entries.

There are 5 different categories of books, that represent the recommended path. For example, you start with Coding books, after that, you read books about Programming, Design and so on.
There are some books about C++ that I recommend not because you shall know C++, only because the concepts that you can learn from it.

Coding

Writing solid codeCode completeProgramming Pearls, more programming pearls(recommended)[NEW] Introduction to Algorithms

Programming

Refactoring (M. Fowler)Pragmatic ProgrammerClean code[NEW] Software Engineering: A Practitioner's Approach[NEW] The Mythical Man-Month[NEW] The Art of Computer Programming

Design

Applying UML and Patterns (GRASP patterns)C++ coding standards (Sutter, Alexandrescu)The C++ programming language (Stroustrup, Part IV)Object-oriented programming (Peter Coad)P…