Web API 2: Random 401 unauthorized on POST

Question

I'm currently building an Angular 2 + ASP Web API 2 application and came across an annoying authorization issue.

I can create an account and log in using the standard identity framework without any problem using the bearer token, but when I'm trying to POST data to my controller I have a 401 authorization ... which occurs only on the second call.

Here is for example the first POST which worked perfectly fine:

Accept:application/json, text/plain, */*
Accept-Encoding:gzip, deflate, br
Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Authorization:Bearer 2x4FSZqJ6Msos870_gIl4aKjgdms1PEGNnFp2ptM6Rrgs4vtmvnMdu2nzEfBoly15CI2bQss5DVe-bkN2uSTHrMP7F6blK90DcFt095xTsWk3BJ_5RiZ-jsXOrqTZaisChIbWgGN0o-DiTEA_ojFKImgsX9yip6hloZ6GI_Cd0eg6EjX6S_PUmmyI13oiBAHKROmDvVoB4y0-DbHPnAO--x9yGxU1z_SRwFYqX8Dua7oAvpbyl2VFIqqA39DlQ0E9JPaRC0gvrBxeS-nibAaBeDUwLSAQm6HOe-vynVhQeGrBvHl7r3gicaNdaS5UZvrC43KFTe6__wR1aDaIgpMejlp-eVnjTVbcxvR16XOXrud1W-tNcoOHtoMdGKKb0IvfxK_GCety5eiiTIGWUpA26nF5cCZEIna8ZJawXRiBZVV__MEPDBlR68mJHvHVKfm5w_jupwF5_oehcKwbT_QZ92hxg4UV8uUaiisqbIe7jQ
Connection:keep-alive
Content-Length:60
Content-Type:application/json
Cookie:.AspNet.Cookies=wcZzztFwOl41pBDgXshPnYCaaQhULRqu9O6grYPDhUx4cSY8PRY1oBRQLs3gPz4ySoxQBaaehtCLDeOFzXAN7q_UMbZps82aCajwvBQewtu_SLizCRTU9UHncWy0EFnJtLAuF5u_8sKW6sNNPTHfDtmjl3UVQkkvYDBceJC5F-sISGqH-sPFwEGmoXgcKLHWfPlejxAvRCRvGbhFhrdKpk_sycoi_B0sBe9Kc8EULXlybEeUolyyrY7L5HvOUIuujLThILt6ipYEmIk8b_2x32uCq7euh5Y_RDzI009SMceOSBs6HYsqUxz6lR2F3KvlcYBQ3rDr8qALhJBnMyJsysdDIruF9dVjK7-IjdEBPXMsGCnHK5gQs_1bIflSaPBbxVPn2VzPui-WChDCdoVXRgGRRnaEtkzaTOhBZIjlLZ1DWS1MqkM-V0khFQxBDqsxll0pZTgNZuwEOLBYoWWiAK9fATXLSmtMYA2UMKoAE0M
Host:localhost:56762
Origin:http://localhost:56762
Referer:http://localhost:56762/tasks/details;id=null
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

With this data: {Title: "Test", Category: "Test", Entries: []}

And now the one returning a 401 error, performed a few seconds later:

Accept:application/json, text/plain, */*
Accept-Encoding:gzip, deflate, br
Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Authorization:Bearer 2x4FSZqJ6Msos870_gIl4aKjgdms1PEGNnFp2ptM6Rrgs4vtmvnMdu2nzEfBoly15CI2bQss5DVe-bkN2uSTHrMP7F6blK90DcFt095xTsWk3BJ_5RiZ-jsXOrqTZaisChIbWgGN0o-DiTEA_ojFKImgsX9yip6hloZ6GI_Cd0eg6EjX6S_PUmmyI13oiBAHKROmDvVoB4y0-DbHPnAO--x9yGxU1z_SRwFYqX8Dua7oAvpbyl2VFIqqA39DlQ0E9JPaRC0gvrBxeS-nibAaBeDUwLSAQm6HOe-vynVhQeGrBvHl7r3gicaNdaS5UZvrC43KFTe6__wR1aDaIgpMejlp-eVnjTVbcxvR16XOXrud1W-tNcoOHtoMdGKKb0IvfxK_GCety5eiiTIGWUpA26nF5cCZEIna8ZJawXRiBZVV__MEPDBlR68mJHvHVKfm5w_jupwF5_oehcKwbT_QZ92hxg4UV8uUaiisqbIe7jQ,Bearer 2x4FSZqJ6Msos870_gIl4aKjgdms1PEGNnFp2ptM6Rrgs4vtmvnMdu2nzEfBoly15CI2bQss5DVe-bkN2uSTHrMP7F6blK90DcFt095xTsWk3BJ_5RiZ-jsXOrqTZaisChIbWgGN0o-DiTEA_ojFKImgsX9yip6hloZ6GI_Cd0eg6EjX6S_PUmmyI13oiBAHKROmDvVoB4y0-DbHPnAO--x9yGxU1z_SRwFYqX8Dua7oAvpbyl2VFIqqA39DlQ0E9JPaRC0gvrBxeS-nibAaBeDUwLSAQm6HOe-vynVhQeGrBvHl7r3gicaNdaS5UZvrC43KFTe6__wR1aDaIgpMejlp-eVnjTVbcxvR16XOXrud1W-tNcoOHtoMdGKKb0IvfxK_GCety5eiiTIGWUpA26nF5cCZEIna8ZJawXRiBZVV__MEPDBlR68mJHvHVKfm5w_jupwF5_oehcKwbT_QZ92hxg4UV8uUaiisqbIe7jQ
Connection:keep-alive
Content-Length:62
Content-Type:application/json
Cookie:.AspNet.Cookies=wcZzztFwOl41pBDgXshPnYCaaQhULRqu9O6grYPDhUx4cSY8PRY1oBRQLs3gPz4ySoxQBaaehtCLDeOFzXAN7q_UMbZps82aCajwvBQewtu_SLizCRTU9UHncWy0EFnJtLAuF5u_8sKW6sNNPTHfDtmjl3UVQkkvYDBceJC5F-sISGqH-sPFwEGmoXgcKLHWfPlejxAvRCRvGbhFhrdKpk_sycoi_B0sBe9Kc8EULXlybEeUolyyrY7L5HvOUIuujLThILt6ipYEmIk8b_2x32uCq7euh5Y_RDzI009SMceOSBs6HYsqUxz6lR2F3KvlcYBQ3rDr8qALhJBnMyJsysdDIruF9dVjK7-IjdEBPXMsGCnHK5gQs_1bIflSaPBbxVPn2VzPui-WChDCdoVXRgGRRnaEtkzaTOhBZIjlLZ1DWS1MqkM-V0khFQxBDqsxll0pZTgNZuwEOLBYoWWiAK9fATXLSmtMYA2UMKoAE0M
Host:localhost:56762
Origin:http://localhost:56762
Referer:http://localhost:56762/tasks/details;id=null
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

With this data: {Title: "Test2", Category: "Test2", Entries: []}

I see no real differences between my two posts. They basically are the same. When I refresh in the browser, re-log, and do these tests again, it behaves the exact same way: 1st request returns HTTP 200, second HTTP 401.

Here is my controller action:

[HttpPost]
[Route("Create")]
[InjectUserIdInServiceFilter]
public int CreateTask(CreateUpdateTimedTaskViewModel timedTask)
{
      var model = this.mapper.Map<CreateUpdateTimedTaskViewModel, TimedTask>(timedTask);
      return this.taskService.Create(model);
}

With my controller definition being the following:

[Authorize]
[RoutePrefix("api/TimedTask")]
public class TimedTaskController : ApiController

Please note that I use the default auto-generated code for the Identity / OAuth / Owin part; I didn't alter its behavior.

Does anybody have any clue about what is happening?

Thanks in advance

T. Thomas

Answer 1

Ok so I figured out what was wrong, after about 4-5 hours of investigation.

The issue didn't come from the back end side (web api / MVC or anything), but from the client side.

I had a wrapper around the "http" of angular 2 used to automatically create the headers to use during the call, and the logic here was flawed ending up in a duplication of the "authenticate" header, making it invalid.

I was appending Authenticate: Bearer XXXXXX on the first call, which was working, and corrupting this header on the second call.

If you look closely the "Authenticate" of the second call, the token is repeated two times, thus resulting in an authentication issue.

I only could figure it out while debugging the C# part step by step, allowing me to notice that the Authenticate header was empty in the Request.Headers.

This issue was really tricky to find, because all the error messages were misleading to the wrong direction.