Search code examples
breeze

Passing Authentication Token with Breeze query

My server side breeze api calls require me to validate the token value provided with each call before returning any data. To achieve this, i am passing TokenId with each Entity Query using withParameters function of breeze Entity Query and specify the parameter on my server side controller action as illustrated below.

Following is how i am doing it right now:

Client Side

function GetCustomers(){
    return breeze.EntityQuery.from('Customers')
    .withParameters({ TokenId: 'token value' })
    .using(entityManager).execute() 
}

Server Side

[HttpGet]
public IQueryable<Customer> Customers(string TokenId)
{
     //server side logic
}

This for some reason looks to me can be simplified using some configuration on Breeze Entity Manager which automatically adds the parameter value to every query sent from client. And also, on server side, i don't think its necessary to have tokenId parameter defined on each controller method. This should be easy to solve with Action Filters on the server side.

Can someone point me in right direction if it is possible and how to do this?

Thanks

Solution

  • You should always pass custom authentication information, such as tokens, in the headers.

    If you can pass it as a custom header you can search for 'define custom headers breeze.js' to see how that can be done.

    A good example - http://breeze.github.io/doc-js/server-ajaxadapter.html

    Also keep in mind that if you put the token in the query string that is persisted by most of the servers that your call is crossing over, making it much easier to find tokens for your application if an evil-doer were to download the logs from that server.

    Also keep in mind that if you are using cross-domain requests (CORS) you will need to enable the custom header on the server side that is receiving the call.