Update Signalr hub authentication docs - #118
Merged
Merged
Conversation
The SignalR page covered route management but said nothing about how a hub authenticates or authorizes its callers, even though the chat hubs ship with authorization hooks that permit everything until they are overridden. - Describe the connection level and per-invocation authorization models, and list the hook each chat hub exposes along with its permissive default. - Show how headless clients authenticate with a bearer token, including the `access_token` query string that SignalR falls back to during a WebSocket handshake. - Explain when to require a scheme listing policy on a hub, and why that policy must not be applied to a hub that also accepts anonymous callers. - Warn against resolving the caller through `IHttpContextAccessor` inside a hub invocation, and point to `Context.User` instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request adds comprehensive documentation on authentication and authorization for SignalR hubs in CrestApps, clarifying how to secure hubs and handle user identity in various scenarios. The new section explains both connection-level and per-invocation authorization models, demonstrates how to support headless clients with access tokens, and provides guidance on handling multiple authentication schemes and user identity within hubs.
Authentication and Authorization for SignalR Hubs:
Added a new section explaining that
AddCoreSignalR()does not configure authentication, and thatapp.UseAuthentication()must run before endpoint routing for hubs.Outlined two authorization models for hubs:
[Authorize]on the hub class to reject unauthorized connections during negotiation.AuthorizeProfileAsync) to check access for each method call; default implementations allow all access, so they must be overridden for security.Provided instructions and code samples for authenticating headless clients (e.g., SPAs, mobile apps) using bearer tokens via the
access_tokenquery parameter, including configuration for the JWT bearer handler and client-side token provision.Explained how to support multiple authentication schemes (e.g., cookies and tokens) on a single hub by creating an explicit authorization policy