Bin and Obj Are the Devil

Tuesday, June 19, 2018

the first in what is likely a series on cache invalidation being hard. tl;dr - close Visual Studio and delete your obj/ and bin/ directories if your project isn’t building and giving cryptic errors. Your project was working fine, but now all of a sudden it can’t find a reference whose location didn’t change. Or it won’t build because something is out of date. Or the version is incorrect. Maybe your project is suddenly throwing errors like cannot find source file or xxx does not exist in namespace yyy. Or maybe System.String can't be found, or byte[] is not a valid type, or System.ValueTuple2 cannot be found. …

#region Is Fine

Monday, June 18, 2018

Occasionally you’ll encounter someone whining about using C#’s #region / #endregion feature in your code. The complaints always boil down to one thing: Overuse of regions is indicative of bad design because it promotes hiding flaws in class structure. Mostly they mean that the class is too big and should be split up. That’s not a necessarily bad observation on its face, but it’s farcical to blame bad design on using regions. If you got rid of regions, your code would still be bad. As a side note, can we also stop using the term “code smell”? I find it grotesque. Anti-pattern is fine, even if it trades its grossness for the sound of conceit. …

Implement an OAuth 2.0 Server (Part 19)

Monday, June 18, 2018

Welcome to the nineteenth and final part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Pushing to Azure To finish off this project, we’ll be deploying our application to the free tier of Microsoft Azure. We’ll be taking most of our cues from Nate Barbettini’s excellent Little ASP.NET Core Book For the purposes of this tutorial, I assume you already have a Microsoft account and are willing to use it to deploy to the cloud. …

Implement an OAuth 2.0 Server (Part 18)

Monday, June 18, 2018

Welcome to the eighteenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Rate Limiting - Attribute Creation We left off last section with rate limits being granted to the to clients and tokens at creation time, but we don’t yet have a way to check those limits when they call our API. To do so, we’ll be making an Attribute that we can use to decorate the controllers or methods that we want to be rate limited. …

Implement an OAuth 2.0 Server (Part 17)

Monday, June 18, 2018

Rate Limiting - Models and Provider Changes There are any number of different ways to implement rate limits - the approach we will follow is outlined like so: All endpoints under /v1/api are limited, no endpoint is free. All endpoints share a limit. Calling /me 1,999 times, then /albums once will rate limit you on the next call. (Assuming a limit of 2,000 for some timeframe.) Renewing a token counts towards the limit - after all, the token endpoint is underneath /api/v1/. Different levels of authorization are granted different rate limits. In descending order of highest rate limits: Authorization Grants Implicit Grants Client Credentials Rate limits are incremented against both a client + user combo, and then again against just the client. This has implications we’ll explore below A given client can be granted a rate limit override. The overall limit of a client can be overridden, and The limits granted to subordinate tokens can be overridden Rate Limits are on a rolling timespan of 1 hour Calls collect for an hour after the initial call, and are purged at the expiration of that hour. Implications of User + Client separate from Client limits In our implementation, a given client will have two rate limits: One for each user that requests a token, with a varying default based on the grant_type, and one for the client itself. The client one will be exponentially higher than the one applied to the users. …

Implement an OAuth 2.0 Server (Part 16)

Monday, June 18, 2018

Welcome to the sixteenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Token Revocation Token revocation is the process of invalidating already issued tokens. Because tokens are serialized with server data taken at a snapshot in time, there is no way for a token to know whether it’s been invalidated, except for when it comes to its expiration date. Further, there’s no given way for the server to know a token has been revoked either - at least, not without a backing datastore. …

Implement an OAuth 2.0 Server (Part 15)

Monday, June 18, 2018

Welcome to the fifteenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Scope Authorization with Policies, Requirements and Handlers Just adding Authorization attributes is insufficient for our purposes - our tokens have scopes associated with them, and our endpoint authorization checks should reflect that. To do so, we will use policies, which you can read about on the Microsoft Docs. Policies are fragments you can add to an authorization attribute that confirm whether a given HttpContext meets the requirements of the attribute, beyond simply being authenticated or not. …

Implement an OAuth 2.0 Server (Part 14)

Monday, June 18, 2018

Welcome to the fourteenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Adding OAuth Validation Our server successfully issues the three token types, but we don’t have a way to actually force a token check on our endpoints yet. One of the packages we downloaded initially was AspNet.Security.OAuth.Validation. We’re going to use that to add OAuth Validation to our server. In Startup.cs's ConfigureServices, add .AddOAuthValidation() to the Authentication chain: …

Implement an OAuth 2.0 Server (Part 13)

Monday, June 18, 2018

Welcome to the thirteenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Identity, Claims, and Authorization Tickets We’ve been skirting talking about claims and authentication tickets by hiding all of it behind our TicketCounter class. You can get a in-depth overview of what those are over at the Microsoft Docs. Claims are how the ASP.NET team has approached identity and authorization details since about 2016. The short of it is that claims are a way of specifying permissions - certain things have claims, other things have claim requirements, and if your claim matches the claims requirement, then you can access the resource locked behind the claim. They’re a bit like roles, but more low level: roles are just a special claim on an IdentityUser. …

Implement an OAuth 2.0 Server (Part 12)

Monday, June 18, 2018

Welcome to the twelfth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Authorization Request Accept/Deny View Two of the the three flows we support, Implicit Grant and Authorization Code, are interactive flows - they require that the user be presented with a screen where they can accept or deny the authorization request. As a preview, this is what our auth page will look like: …