Getting logged in user from .Net Core 3.1 Web API - unity3d

I've been struggling with this implementation for months. I had a workaround but it's far from ideal.
I've been struggling to get access to the current logged-in user from within my Web API. Ordinarily, I'd perhaps log in through the client and then authorise through a token. The problem I have, however, is that the client isn't the software that makes the log in request.
The client is written in Unity 3D and is embedded into the site. It shares data with the site via a Web API. Before the user gets access to the client, however, they have to log into the site through a standard .Net Core login system. So, as you can see, there's no way to pass an authentication token to the client. What I'm trying to do is have the Web API respond to requests by accessing only the details of the current logged-in user.
At the moment, I've tried gaining access to user data via HttpContext but in order to do that, I've had to enable Windows Authentication in the project. But now, all calls to the Web API result in a 401 error as the client itself can't send any authentication information.
So, what I need to do is find a way to get current logged in user information inside a Web API where the API doesn't need to receive any tokens or other information to do it.
Any ideas how that might be possible?

UPDATE 5/8/2020
Passing authentication token from web to Unity 3D
Since you have less detail about client, I take a example about Unity Web Player and browser communication.
Calling Unity web player content functions from the web page
The Unity Web Player object has a function, SendMessage(), that can be called from a web page in order to call functions within Unity web player content. This function is very similar to the GameObject.SendMessage function in the Unity scripting API. When called from a web page you pass an object name, a function name and a single argument, and SendMessage() will call the given function in the given game object.
<script type="text/javascript" language="javascript">
<!--
//initializing the WebPlayer
var u = new UnityObject2();
u.initPlugin(jQuery("#unityPlayer")[0], "Example.unity3d");
function SaySomethingToUnity()
{
u.getUnity().SendMessage("MyObject", "MyFunction", "Hello from a web page!");
}
-->
</script>
You can use to send authentication token.
So, what I need to do is find a way to get current logged in user
information inside a Web API where the API doesn't need to receive any
tokens or other information to do it.
If we have a API to get tokens as you expect, then you access all APIs with this token. Authentication will be useless and system becomes unsafe. Because everyone can access with the magic api.

Related

How should I approach integration testing for APIs involving Facebook?

The scenario
Suppose there is a mobile app connected to a backend API (nodejs, though not that important), and you can "register with Facebook".
Registering with Facebook implies a couple of steps: on the mobile part the user authorises FB access, FB provides the app with a token, that token is sent to the server and (let's suppose using a passport-facebook strategy) that token can be sent again to FB along with app credentials so that FB can transform that token into a User object.
Suppose on the backend side you use that User object to create your own App User entry, fetch the profile picture and store it, etc. And by manually testing you can see that the User object has a specific structure: an id field, an emails field (which is an array with a complex structure), etc. You end up writing you registration steps based on that.
The problem
While I know that the FB returned User object looked in a certain way at a certain point in time I cannot be sure it will be the same in the future and I won't get an "cannot access something of undefined" error message when they decide to change the structure of that. On the other hand I would really like to have integration tests that include third party integrations, like FB.
I know that you can have (virtual) FB test users and I checked out their documentation for testing, it only shows example of Mobile app testing as far as I know, no backend oriented testing.
I would ideally need to be able to either fetch a (test or not) FB User with which I can test out my registration process or even better a token that can be used in the whole API flow, so that the whole process is covered. Any ideas where I should look or if it is worth investing in this direction?

How to get a bearer token to access an API from an MVC application

My user flow is as follows...
User requests a protected resource.
User redirected to authentication provider (e.g. Google)
User redirect back to ASP.Net MVC application which uses cookie authentication.
This works great, and following the MVC sample application from the IdentityServer samples I can see a list of claims for my user.
So the main page of my application is rendered using an MVC view, I have other resources which are authorised via resource authorisation and this works great.
The next part of my application is an API. Let's say it's api.domain.com/stockquote
This should only be useable by authorised users of my application and not publically available.
I have successfully made an Angular JS application with Identity Server and understand that when the token is returned I am able to get the value of /id_token from the URI, store it in localstorage and then use it to form an authorisation header for the API e.g. Authorization=Bearer {token} . Again works nicely.
However, now I am authenticated into my MVC application how do I get this token and put it into local storage so that I can create a header for my API calls?
Can I extract it from the cookie somehow?
Is it a good idea to output it in the HTML stream so that JS can pick it up and put into localstorage (guessing now).
Can I use the token endpoint to somehow get this token?
One way to handle this might be to change the way you authenticate. Instead of handling the callback in MVC on the server side, handle it in JavaScript. Then the token is available for you to store in local storage. This might not be possible if you are making requests on the server side that uses the token as well.

Using Facebook or Google login API with Classic ASP

I'm running a Classic ASP website, that has its own user authentication and login mechanism. For example, In order to remember a logged-in user, ASP creates an encrypted cookie and a 20-minute session for each connected user. If the 20 minute session is elapsed, the server revives the session from the cookie saved previously, and saves some data regarding the user to the database.
I want to to be able to allow users to connect with their Facebook or Google identity, but the mechanism used by Facebook or Google is based mainly on Javascript and on client-side code.
How Facebook or Google login can be used while maintaining server side code in ASP? (So that the ASP server can still manage the session and save data regarding it, for example whenever a session is revived)
For me somehow it seems that it may become less secure to use client-side authentication as the code may be altered easily. Isn't this the case?
If I use client-side javascript and log in with Facebook, how would I update the user data retrieved from facebook back into my database, for example the user's first and last name?
For me it sounds that it should be a "server-to-server" communication (between my ASP server and Facebook's or Google's servers) and what they propose is a "client-to-server" communication ... Any ideas how this can be done?
Any help or explanation would be very much appreciated! Thanks.
I'll try to address your Facebook-related questions one by one. However, I will not give you an implementation or any ASP-specific feedback, but only a rough approach. Additionally, I recommend that you study Facebook's documentation on Facebook Login extensively to further your understanding of the matter.
1. Facebook documents the server-side OAuth 2.0 flow in their Manually Build a Login Flow guide. Basically you redirect the user to a specific FB URL that (in the parameters) tells FB to render the "Login with Facebook" dialog, and which permission scopes to ask for. Once the user approves the Facebook Login for your webapp, they will be redirected back to your web app, e.g. with an OAuth token in the query string, that your webserver can then exchange for a user access token.
Once you obtained a user access token, you could e.g. store it in your web app user's session.
2. I don't know what you mean. Client side apps are fairly secure. Perhaps you can convince yourself about how secure JS apps are when reading about things like CORS.
3. If you only use JavaScript (e.g. Facebook's JS SDK) and you want to store e.g. app-scoped user IDs on your server, you need to expose an endpoint on your server that your JS application can submit that kind of information to.
4. You state
what they propose is a "client-to-server" communication
Who are "they", and where are the proposing this? The resources I linked to in 1. should explain how you can use Facebook login in a pure server-to-server way.

Facebook, Node & Mobile app - pulling together

I'm trying to build a Facebook-authenticated native mobile app (Windows Phone) that connects to a web service I am creating in Node.
I'd like for a user to:
Log in to Facebook on the mobile app via a native UI or web window
If logged in successfully, create or access server-side user account data tied to that identity
Use the authenticated session to make subsequent authenticated requestsvto that user's data via the native mobile app
My question is: What's the best approach here?
Should I...
Log in the client to facebook locally in the mobile app and pass the Access Token to the node service, and then somehow map the user to my service data based on their facebook account id? That seems grossly insecure if I just pass that token in the URL.
Log the user in via a mobile browser window inside my app, and then redirect back to my Node service in the same window? How do I then make subsequent authenticated requests natively in my app?
Do something else entirely?
Sorry this is so open ended but this is the first time I have tied these things together and although there's a lot of info on each part I've yet to find something that describes the overall pattern / best practice for this design.
Your question is quite opinion based...but still I will try to help.
First of all, you can pass access token in url, its not insecure if you use https. Even if logged into facebook from your mobile app, than also its going to pass a access token in url only. If you mean having the token in http://something.com/access_token, than its not how its should be done.
If you look into the Oauth 2.0 draft you will understand that its done through setting a header Authorization with the value being the token and token_type. Take a good look at the draft.
As your solution I think its fine if you just use the first method mentioned in the question by sending the access token in header as I mentioned in your app and in turn authenticating that token from facebook on each request.
If you think this is just too long a flow for authenticating every request from facebook, than you can get access token by sending request from your mobile app to server and let the server handle the access token and store it in database which you can authenticate each request.
In any case take a look at Passport module, it has facebook and other auth built-in and should be sufficient for your needs.

how can get data from facebook api and write those data in my own database using web services?

For this task I have already created my own facebook application to get the API key and secret key. Can anyone explain the next steps that should be done to
1) Read from facebook API
2) Write my own database
by using web services
Thanks in advance!
A high level answer:
I'm assuming you want to use the authorization code OAuth flow (this means you want Facebook users to give you access to their profiles so you can grab data from there). If so, you need to bring up a web server and an application that will run your users through the Facebook OAuth flow. In case you just want to access Facebook with your own credentials you don't have to have a web server, simply use the client credentials OAuth flow.
So, Once you have a valid access token, you simply make calls to Facebook API using this token. using Facebook Graph API is simply a matter of calling URLs and getting the data as JSON.
You can test-drive the API here.
BTW, according to Facebook's platform policy, you're only allowed to store Facebook data for caching purposes.
Let me know if this helps.