how to authenticate

[BernhardR]

Hi,
from the readme I learned to use the webserver.Routes.AuthenticateRequest = Authrequest; to establish a login.
Within that function I may need to check if posted credientials are valid. I still don't understand how to save this result to the session of the user. Each reuest to the server first lands in AuthenticationRequest.
How could I save the successful login, so that I can know the user is logged in?

[BernhardR]

selfanswering;

In authenticate I do this:

if (postParams["username"] == _myConf.userName && postParams["password"] == _myConf.userPassword) { _myLog.WriteLog("Authrequest: User " + postParams["username"] + " authenticated."); return; // everything is good - cookie will be set from default page after login }

and in default route I do this:
string cookie = ctx.Request.Headers.Get("Cookie"); if (cookie == null || cookie == "empty") // set cookie only once { string guid = Guid.NewGuid().ToString(); _goodUsers.Add(guid); // a global simple string list ctx.Response.Headers["Set-Cookie"] = guid; // set the cookie to let the client log in automatically _myLog.WriteLog("DefaultRoute: user added " + guid + " cookie " + cookie); }

this is doing the job from my perspective

[jchristn]

Hi @BernhardR thanks for your note. In HttpContextBase, there is a property called Metadata which is user defined and user managed. Often in my authentication I will persist any data retrieved in that property.

[BernhardR]

I did not understand how to set the metadata permanently - if I set it before "send" at the same time I set the cookie, it does not become permanent - means on the next request in the same session the metadata is empty. Could you point me to the correct implementation example?

[jchristn]

That's correct, it's temporal and only valid for the lifetime of the HttpContextBase. If you need something persistent, I would use cookies or something similar too. I generally, in my authentication method, retrieve user details, API key details, etc, and put those in a custom object which is then attached to the Metadata property so that other routes can use it. In your case, yes, use something like a cookie or something persistent beyond the lifetime of the context.