OWIN cookie authentication get roles on client side

问题

I'm developing an application where backend is asp.net owin based. In Startup.cs I have IAppBuilder.useCookieAuthentication() { ... }. After successfully authenticated, current user with its roles can be accessed via HttpContext in all my web api controllers.

My javascript client side needs a knowledge about these roles in order to know how to display specific items. For example: user having administrator role can see additional tabs.

My question is: what's the best way to 'transfer' these roles to client side. Is it by writing some endpoint which will return these roles, or any other way?

Thanks

回答1:

I totally agree with @cassandrad !

But if you want to access it as plain text, than you have to provide your own implementation of TicketDataFormat in the CookieAuthenticationOptions

public class CustomAccessTokenFormat : ISecureDataFormat<AuthenticationTicket>
{
    // If you want to do custom serialization and encryption
    public string Protect(AuthenticationTicket ticket)
    {
        return "UserName|Role1|Role2|..."; // your raw text serialization goes here
    }

    // Deserilaize and decrypt the ticket
    public AuthenticationTicket Unprotect(string strTicket)
    {
        return new AuthenticationTicket(null, null); // deserialize the plain text here into an AuthenticationTicket object
    }
}

回答2:

You don't need to pass information about roles or permission in “raw” state to the client-side. Instead, you should have AuthenticationTicket — the thing that holds all information protected and encrypted. So, if you are using correct implementation of OWIN middleware, there is no need to do something by yourself — middleware will add all the necessary data to your response(inside cookies), client only need to resend this information back to the server next time when he wants to access some resources on the server.

And yes, I'm implying that you shouldn't have any information about permissions on your client-side — it is not secure.

来源：https://stackoverflow.com/questions/37816767/owin-cookie-authentication-get-roles-on-client-side