DevelopmentHangfire dashboard access with JWT token authentication

by Anthony Sapountzis

While attempting to access the Hangfire dashboard of a ASP.NET Web APIAn API is an Application Programming Interface. APIs are used to allow systems to retrieve data from other systems. It... project recently, we realised we had been denied access.

Earlier this year we changed our development stack and began using Angular and ASP.NET Web APIAn API is an Application Programming Interface. APIs are used to allow systems to retrieve data from other systems. It.... Before this change, we were using ASP.NET MVC systems utilizing Razor views. We also use Hangfire for background processing, which allows us to offload certain processing to background threads. Once we had deployed our first project we realized that some of our Hangfire tasks weren’t completing and in attempting to debugDebugging is the process of a developer working through code in order to try and find any error or bug.... the issue we tried to view the Hangfire dashboard. When we were greeted with a white page we realized that we did not have access to the dashboard. Our custom HangfireAuthorizationFilter was denying us access because it was still validating users against the HttpContext object.

Our APIAn API is an Application Programming Interface. APIs are used to allow systems to retrieve data from other systems. It... was using JWT bearer tokens for authorizationAuthorization and authentication are generally used interchangeably by most people. However, there is a big difference between authorization and authentication...., so we needed to take another look at our HangfireAuthorizationFilter logic.

We have no dynamic or static pages within our project and therefore no traditional login page. We needed a way to get our bearer token decoded and verify the claims within the token. Our firsts thoughts were to pass the token through URL parameters. We realized that once this was implemented, it would only work for the initial page load; navigating through the dashboard would still deny us access whenever we clicked a link. It was at this point we decided to use a which would be present for all requests. This would be added to the browser using dev tools and would contain the JWT bearer token

The code within our custom HangfireAuthorizationFilter was modified as below

public bool Authorize([NotNull] DashboardContext context)
{
#if DEBUG
	// If we are in debug, always allow Hangfire access.
	return true;
#else
	// if we have a cookies and we are in release mode
	HttpCookieCollection cookies = System.Web.HttpContext.Current.Request.Cookies;
	if (cookies["custom_cookie_name"] != null)
	{
		HttpCookie jwtCookie = cookies["custom_cookie_name"];
		string jwtToken = jwtCookie.Value;
		JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
		JwtSecurityToken securityToken = handler.ReadToken(jwtToken) as JwtSecurityToken;
		// return true or false based on the presence of a specific claim e.g role claim
		// string role = securityToken.Claims.First(claim =&gt; claim.Type == "role").Value;
		// return role == "THE_ROLE_WE_ARE_LOOKING_FOR";
	}
	return false;
#endif
}

On line 3 if we have built in we always return true. Otherwise on line 6 we look for the presence of a specific [cci]custom_cookie_name[/cci]. If this is present we use its value (the bearer token) and look for the presence of a specific claim. Our logic verifies that there is specific role claim present. If this role is present we return true, granting access, otherwise false which denies access.

It is within this code block where you would apply logic relevant to your code base.

In order to make this process work, we use Postman to create an APIAn API is an Application Programming Interface. APIs are used to allow systems to retrieve data from other systems. It... request to our token URL (e.g. [cci]http://systemurl/token[/cci]) and use the return bearer token as the value that our cookieA cookie is a piece of web technology used within your browser to store information while you are not on... contains.

DevelopmentHangfire dashboard access with JWT token authentication

Services

Company

Connect with us