bearer-token | 易学教程

IE11 overrides Bearer authorization header in intranet environment

阅读更多关于 IE11 overrides Bearer authorization header in intranet environment

问题 I'm encountering a pretty strange issue in IE11 where the browser is overriding the Authorization header in my requests even though I am setting it via AngularJS. Basically, I have an HTTP interceptor registered for all requests that looks like this: AuthInterceptorService.request = function (config) { config.headers.Authorization = "Bearer " + bearerToken; } This works great in all browsers (even IE under certain conditions). I have my app set up in IIS as allowing anonymous authentication

Custom Bearer Token Authorization for ASP.Net Core

阅读更多关于 Custom Bearer Token Authorization for ASP.Net Core

Is this an acceptable implementation of a custom bearer token authorization mechanism? Authorization Attribute public class AuthorizeAttribute : TypeFilterAttribute { public AuthorizeAttribute(): base(typeof(AuthorizeActionFilter)){} } public class AuthorizeActionFilter : IAsyncActionFilter { private readonly IValidateBearerToken _authToken; public AuthorizeActionFilter(IValidateBearerToken authToken) { _authToken = authToken; } public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next) { const string AUTHKEY = "authorization"; var headers = context

401 when authenticating an OAuth 2.0 bearer token with Microsoft Azure Active Directory in an MVC API

阅读更多关于 401 when authenticating an OAuth 2.0 bearer token with Microsoft Azure Active Directory in an MVC API

I'm writing an API service in MVC (no views, just API), and I want to use OAuth 2.0 tokens acquired via the client_credentials flow (2-legged OAuth). I created an ActiveDirectory app in the Azure management portal , and have successfully acquired a bearer token (see screenshot from Postman at the bottom). Then I installed the Microsoft.Owin.Security.ActiveDirectory nuget package, created an Owin startup class and wrote the following code in it: public class OwinStartup { public void Configuration(IAppBuilder app) { // For more information on how to configure your application, visit http://go

Authorization header not making it through in Codeception API testing

阅读更多关于 Authorization header not making it through in Codeception API testing

I am attempting to test my Laravel 4 REST API using Codeception, but when I try to send through my Authorization header (using the $I->amBearerAuthenticated() function of the REST module) it is not making it through to the eventual request. From what I can see, the Symfony2 BrowserKit module modifies any headers added into the HTTP_XXX_XXX format, so the header being sent seems to be HTTP_AUTHORIZATION - when I output the received headers in my application, however, neither Authorization nor HTTP_AUTHORIZATION are present. If it helps, here is my Codeception test: public function

SignalR authentication failed when passing “Bearer” through query string

阅读更多关于 SignalR authentication failed when passing “Bearer” through query string

问题 I'd like to enable authentication in SignalR while the server was hosted in ASP.NET WebAPI which I'm using OAuth Bearer authrntication and the client is AngularJS. On client side I originally pass the Bearer token through HTTP header and it works well with the WebAPI. But since SignalR JavsScript doesn't support adding HTTP headers in connection (it's because WebSocket doesn't support specifying HTTP headers) I need to pass the Bearer token through query string by using the code like self

Authorization in ASP.NET Core. Always 401 Unauthorized for [Authorize] attribute

阅读更多关于 Authorization in ASP.NET Core. Always 401 Unauthorized for [Authorize] attribute

For the first time I'm creating Authorization in ASP.NET Core. I used tutorial from here TUTORIAL The problem is when I sending request from postman: Authorization:Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6I... to my method in controller decorated with [Authorize] attribute. I receive 401 Unauthorized always... I saw comments bellow that tutorial and it seems that some people have similar issue also. I've no idea how I can solve this problem. At the request of others here is the answer: The problem was with the middleware order in Startup.cs public void Configure(IApplicationBuilder app,

Yii2 REST api bearer authentication

阅读更多关于 Yii2 REST api bearer authentication

I am using Yii2 framework as the backend and react js for the client side. I am trying to create REST api with HTTPBearer authentication but always get a 401 Unauthorized error . I have followed the Yii2 Rest api authentication with no success. I have also implemented findIdentityByAccessToken on user.php and access_token on my sql. My files:- Folder structure:- -api --config --main.php --main-local.php ... --modules --v1 --controllers --CheckinsController.php -backend -common -frontend .. main.php <?php $params = array_merge( require(__DIR__ . '/../../common/config/params.php'), require(__DIR

Why should you base64 encode the Authorization header?

阅读更多关于 Why should you base64 encode the Authorization header?

问题 Twitter's API requires sending an Authorization header that is a base64 encoding of an API key concatenated with an API secret key. In Node, I use: var base64 = new Buffer(apiKey + ':' + apiSecret).toString('base64'); The header sent becomes: Authorization: 'Basic ' + base64 What is the point of base64 encoding the string "apiKeyHere:apiSecretHere"? Why not just accept an Authorization header containing the raw api credentials? This question is similar to What is the purpose of base 64

Rest Assured Bearer authentication

阅读更多关于 Rest Assured Bearer authentication

I am new to using Rest Assured,Java and Api testing so please be gentle with me. When I use rest assured to test an api that uses Bearer authentication the tests fail resulting in:- java.net.ConnectException: Connection refused: connect I know the issue is likely to do with the authentication but am unsure on how to use "Bearer". I searched around and believe that somehow I need to make an initial request using my username and password. Then get a token back to be used for bearer authentication. Please can someone help me to do this with a very simple example? My code is import com.jayway

OAuth Bearer Access Token sliding expiration

阅读更多关于 OAuth Bearer Access Token sliding expiration

问题 Let's suppose that we're using OAuth Bearer tokens to secure our API. There is NuGet package with OWIN middleware that will do it for us: https://www.nuget.org/packages/Microsoft.Owin.Security.OAuth. Everethig looks great, until raises question about access token expiration - we don't want to force use to re-login over and over again. As far as I understand there are three basic ways: Make Access Token expiration time very big (1 month for instance) Use OAuth Refresh Tokens that adds much