👁 Image
HexaEightMiddleware 1.6.62

HexaEight Middleware

How To Use This Library

Sample Middleware Code (Startup and Configuration Section)

public class Startup
{
 public Startup(IConfiguration configuration)
 {
 Configuration = configuration;
 }

 public IConfiguration Configuration { get; }

 // This method gets called by the runtime. Use this method to add services to the container.
 public void ConfigureServices(IServiceCollection services)
 {
 services.Add(new ServiceDescriptor(typeof(HexaEightResource), new HexaEightResource("18ADCEA59T56FE1427ABC652763DFC47134BDFDBC", "https://tokenserverurl:8443")));
 services.AddSingleton<IAuthenticationService, AuthenticationMiddleware>();
 services.AddAuthentication();
 services.AddAuthorization();
 services.AddCors();
 services.AddControllers();
 }

 // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
 public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
 {
 if (env.IsDevelopment())
 {
 app.UseDeveloperExceptionPage();
 }

 //Enable CORS for all origns including credentials. We will validate the user agents in the authentication section
 app.UseCors(x => x
 .AllowAnyMethod()
 .AllowAnyHeader()
 .SetIsOriginAllowed(origin => true)
 .AllowCredentials());

 //Add HexaEight Middleware first in the pipeline so that valid request can be authenticated.

 app.UseMiddleware<HexaEightEngine.Middleware>();
 app.UseRouting();
 app.Use(async (context, next) =>
 {
 await next();

 if (context.Response.StatusCode == (int)HttpStatusCode.Unauthorized)
 {
 context.Response.StatusCode = (int)HttpStatusCode.OK;
 await context.Response.Body.WriteAsync(Encoding.UTF8.GetBytes("UnAuthorized - Access Denied"));
 }

 });

 app.UseAuthentication();
 app.UseAuthorization();
 app.UseEndpoints(endpoints =>
 {
 endpoints.MapControllers();
 });
 }
}

Sample Weather Controller Code with Authorization for Get and Post

 public class WeatherForecast
 {
 public DateTime Date { get; set; }

 public int TemperatureC { get; set; }

 public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);

 public string Summary { get; set; }
 
 public bool isauthenticated { get; set; }
 public string loggedinuser { get; set; }
 public string location { get; set; }


 }

namespace HexaEight_Middleware_SampleDemo.Controllers
{
 [ApiController]
 [Route("[controller]")]
 public class WeatherForecastController : ControllerBase
 {
 private static readonly string[] Summaries = new[]
 {
 "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
 };


 private static readonly string[] locations = new[]
 {
 "Aberdeen", "Anacortes","Arlington", "Auburn","Battle Ground","Bellevue","Bellingham","Bonney Lake","Bothell","Bremerton","Burien"
 };

 private readonly ILogger<WeatherForecastController> _logger;

 public WeatherForecastController(ILogger<WeatherForecastController> logger)
 {
 _logger = logger;
 }

 [HttpGet]
 public IEnumerable<WeatherForecast> Get()
 {
 var rng = new Random();
 return Enumerable.Range(1, 5).Select(index => new WeatherForecast
 {
 isauthenticated = false,
 loggedinuser = "",
 Date = DateTime.Now.AddDays(index),
 TemperatureC = rng.Next(-20, 55),
 location = locations[rng.Next(locations.Length)],
 Summary = Summaries[rng.Next(Summaries.Length)]
 })
 .ToArray();
 }

 [HttpGet("{resource}")]
 [Authorize(AuthenticationSchemes = "Bearer")]
 public IEnumerable<WeatherForecast> Get(string resource)
 {
 var rng = new Random();
 return Enumerable.Range(1, 1).Select(index => new WeatherForecast
 {
 isauthenticated = true,
 loggedinuser = HttpContext.User.Identity.Name.ToString(),
 Date = DateTime.Now.AddDays(index),
 TemperatureC = rng.Next(-20, 55),
 location = resource,
 Summary = Summaries[rng.Next(Summaries.Length)]
 })
 .ToArray();
 }


 [HttpPost("{resource}")]
 [Authorize(AuthenticationSchemes = "Bearer")]
 public async Task<IEnumerable<WeatherForecast>> Post(string resource)
 {

 string body = "";
 using (StreamReader stream = new StreamReader(HttpContext.Request.Body))
 {
 body = await stream.ReadToEndAsync();
 }
 body = body.ToString().TrimEnd('\0').Trim();

 var rng = new Random();
 return Enumerable.Range(1, 1).Select(index => new WeatherForecast
 {
 isauthenticated = true,
 loggedinuser = HttpContext.User.Identity.Name.ToString(),
 Date = DateTime.Now.AddDays(index),
 TemperatureC = rng.Next(-20, 55),
 location = body,
 Summary = Summaries[rng.Next(Summaries.Length)]
 })
 .ToArray();
 }


 }
}

Sample Authentication Middleware Code For Additional Authorization

public class AuthenticationMiddleware : IAuthenticationService
{
 static string ComputeSHA512(string s)
 {
 StringBuilder sb = new StringBuilder();
 using (SHA512 sha512 = SHA512.Create())
 {
 byte[] hashValue = sha512.ComputeHash(Encoding.UTF8.GetBytes(s));
 foreach (byte b in hashValue)
 {
 sb.Append($"{b:X2}");
 }
 }

 return sb.ToString();
 }
 public Task<AuthenticateResult> AuthenticateAsync(HttpContext context, string scheme)
 {
 try
 {
 if (context.User.Identity.IsAuthenticated && context.User.Identity.AuthenticationType == "HexaEight Identity")
 {

 try
 {
 // Check 1: Weed out MITM. This will ensure replaying the same request through some other orign wont work.
 // Note: This Check wont work for desktop and mobile client apps since orign is expected to be null. Use Check 2 to validate the request
 if (ComputeSHA512(context.Request.Headers["Origin"].FirstOrDefault().Trim().Replace("https://", "").Replace("http://", "").ToLower()) != context.User.Claims.FirstOrDefault(c => c.Type == "OriginHash").Value)
 {
 return Task.FromResult(AuthenticateResult.Fail("UnAuthorized Request - Access Denied"));
 }
 }
 catch { }

 // Check 2: Validate if the request origniated through list a list of accepted user agents/client applications hash values.
 // For example if you are expecting api requests from www.client.com, www.thirdparty.com you will add the 512 hash of www.client.com to below list.
 // For Mobile and Desktop apps, generate the 512 Hash of the executuable and add it below.
 var listofclienthashes = new string[] { "B5E57824692A50458E29E1E35FCAFE1F55DE18C35DBE0901B5AF887BAC068D08E3B34CEA2B722395D0E4CDFC1292D5E8950894D9FFFB48E834026789CC5F1DCA" };

 if (!listofclienthashes.Any(s => s.Contains(context.User.Claims.FirstOrDefault(c => c.Type == "OriginHash").Value)))
 {
 return Task.FromResult(AuthenticateResult.Fail("UnAuthorized User Agent - Access Denied"));
 }

 // Check3 : Validate if the request is more than X seconds, if so reject the request.
 // The below test tests to see if the request is received after 10 seconds, if so the requst is rejected
 if (Int64.Parse((context.User.Claims.FirstOrDefault(c => c.Type == "RequestReceivedAt").Value)) - Int64.Parse((context.User.Claims.FirstOrDefault(c => c.Type == "RequestTimeStamp").Value)) > 10)
 {
 return Task.FromResult(AuthenticateResult.Fail("Expired Request - Access Denied"));
 }

 // TBD -> Check 4 : While Check3 will Prevent most replay attacks, using a bloom filter based on 'RequestHash' value available in the user claims, can repel all replay attacks

 AuthenticationTicket at = new AuthenticationTicket(context.User, "HexaEight");
 return Task.FromResult(AuthenticateResult.Success(at));
 }
 return Task.FromResult(AuthenticateResult.Fail("UnAuthorized"));
 }
 catch
 {
 return Task.FromResult(AuthenticateResult.Fail("UnAuthorized"));
 }


 }

 public Task ChallengeAsync(HttpContext context, string scheme, AuthenticationProperties properties)
 {
 context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
 return Task.CompletedTask;
 }

 public Task ForbidAsync(HttpContext context, string scheme, AuthenticationProperties properties)
 {
 throw new NotImplementedException();
 }

 public Task SignInAsync(HttpContext context, string scheme, ClaimsPrincipal principal, AuthenticationProperties properties)
 {

 return Task.CompletedTask;
 }

 public Task SignOutAsync(HttpContext context, string scheme, AuthenticationProperties properties)
 {
 throw new NotImplementedException();
 }
}

NOTE: Please be aware that, at the moment, HexaEight Middleware accommodates Controller responses ONLY in Array or IEnumerable formats.