Implementation for resolve issue #993

[andersondepaiva]

Fixes / New Feature #

Proposed Changes

• Added IF to check if HTTP method is not OPTIONS
• Issue described: 403 - Http Options - AllowedScopes #993

[vicmaeg]

Hello, we are having a similar problems with the OPTIONS request. By default angular seems to add the OPTIONS before any other request, and since they are failing because of the authentication middleware it fails to do the final request. OPTIONS should not be handled by the authorization middleware.

Edit: but we should take care, that if the we invoke the next after by-passing the authorization middleware and we have configured another middleware like ClaimsToHeaders, etc. it will fail in that middleware.

[andersondepaiva]

Ok, based me in the Authentication class implementation, that follow same solution

public class AuthenticationMiddleware : OcelotMiddleware
    {
        private readonly OcelotRequestDelegate _next;

        public AuthenticationMiddleware(OcelotRequestDelegate next,
            IOcelotLoggerFactory loggerFactory)
            : base(loggerFactory.CreateLogger<AuthenticationMiddleware>())
        {
            _next = next;
        }

        public async Task Invoke(DownstreamContext context)
        {
            if (context.HttpContext.Request.Method.ToUpper() != "OPTIONS" && IsAuthenticatedRoute(context.DownstreamReRoute))
            {
                Logger.LogInformation($"{context.HttpContext.Request.Path} is an authenticated route. {MiddlewareName} checking if client is authenticated");

                var result = await context.HttpContext.AuthenticateAsync(context.DownstreamReRoute.AuthenticationOptions.AuthenticationProviderKey);

                context.HttpContext.User = result.Principal;

                if (context.HttpContext.User.Identity.IsAuthenticated)
                {
                    Logger.LogInformation($"Client has been authenticated for {context.HttpContext.Request.Path}");
                    await _next.Invoke(context);
                }
                else
                {
                    var error = new UnauthenticatedError(
                        $"Request for authenticated route {context.HttpContext.Request.Path} by {context.HttpContext.User.Identity.Name} was unauthenticated");

                    Logger.LogWarning($"Client has NOT been authenticated for {context.HttpContext.Request.Path} and pipeline error set. {error}");

                    SetPipelineError(context, error);
                }
            }
            else
            {
                Logger.LogInformation($"No authentication needed for {context.HttpContext.Request.Path}");

                await _next.Invoke(context);
            }
        }

        private static bool IsAuthenticatedRoute(DownstreamReRoute reRoute)
        {
            return reRoute.IsAuthenticated;
        }
    }

Thank's