C#•2y ago

✅ Endpoint returns 400 when I add authorization code, works correctly without

Here is the authorization code:

    public class UpdateUserAuthorizationHandler : AuthorizationHandler<UpdateUserRequirement>
    {
        private readonly IHttpContextAccessor _httpContextAccessor;
        private readonly UserService _userService;
        private readonly IMapper _mapper;

        public UpdateUserAuthorizationHandler(IHttpContextAccessor httpContextAccessor, UserService userService, IMapper mapper)
        {
            _httpContextAccessor = httpContextAccessor;
            _userService = userService;
            _mapper = mapper;
        }

        protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, UpdateUserRequirement requirement)
        {
            if (!context.User.Identity.IsAuthenticated)
            {
                throw new InvalidTokenException("access");
            }

            var userId = int.Parse(context.User.Claims.First(c => c.Type == "id").Value);

            var httpContext = _httpContextAccessor.HttpContext;
            var bodyData = string.Empty;
            using (var reader = new StreamReader(httpContext.Request.Body, Encoding.UTF8))
            {
                bodyData = await reader.ReadToEndAsync();
            }
            var options = new JsonSerializerOptions
            {
                PropertyNameCaseInsensitive = true
            };
            var userDto = JsonSerializer.Deserialize<UserDTO>(bodyData, options);
            var targetUser = await _userService.GetUserById(userDto.Id);

            if (targetUser != null && targetUser.Id == userId)
            {
                context.Succeed(requirement);
            }
            else
            {
                throw new UnauthorizedActionException(userId);
            }
        }
    }

    public class UpdateUserAuthorizationHandler : AuthorizationHandler<UpdateUserRequirement>
    {
        private readonly IHttpContextAccessor _httpContextAccessor;
        private readonly UserService _userService;
        private readonly IMapper _mapper;

        public UpdateUserAuthorizationHandler(IHttpContextAccessor httpContextAccessor, UserService userService, IMapper mapper)
        {
            _httpContextAccessor = httpContextAccessor;
            _userService = userService;
            _mapper = mapper;
        }

        protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, UpdateUserRequirement requirement)
        {
            if (!context.User.Identity.IsAuthenticated)
            {
                throw new InvalidTokenException("access");
            }

            var userId = int.Parse(context.User.Claims.First(c => c.Type == "id").Value);

            var httpContext = _httpContextAccessor.HttpContext;
            var bodyData = string.Empty;
            using (var reader = new StreamReader(httpContext.Request.Body, Encoding.UTF8))
            {
                bodyData = await reader.ReadToEndAsync();
            }
            var options = new JsonSerializerOptions
            {
                PropertyNameCaseInsensitive = true
            };
            var userDto = JsonSerializer.Deserialize<UserDTO>(bodyData, options);
            var targetUser = await _userService.GetUserById(userDto.Id);

            if (targetUser != null && targetUser.Id == userId)
            {
                context.Succeed(requirement);
            }
            else
            {
                throw new UnauthorizedActionException(userId);
            }
        }
    }

9 Replies

hOP•2y ago

Here is the failing controller:

        /// <summary>
        /// Update user
        /// </summary>
        [HttpPut]
        [Authorize(Policy = "UpdateUserPolicy")]
        public async Task<IActionResult> Put([FromBody] UserDTO user)
        {
            await _userService.UpdateUser(user);
            return NoContent();
        }

        /// <summary>
        /// Update user
        /// </summary>
        [HttpPut]
        [Authorize(Policy = "UpdateUserPolicy")]
        public async Task<IActionResult> Put([FromBody] UserDTO user)
        {
            await _userService.UpdateUser(user);
            return NoContent();
        }

The request I am giving to the controller:

{
  "id": 22,
  "avatar": "https://i.gyazo.com/image.jpg",
  "email": "[email protected]",
  "userName": "abc"
}

{
  "id": 22,
  "avatar": "https://i.gyazo.com/image.jpg",
  "email": "[email protected]",
  "userName": "abc"
}

Error:

{
  "type": "https://tools.ietf.org/html/rfc7231#section-6.5.1",
  "title": "One or more validation errors occurred.",
  "status": 400,
  "traceId": "00-8cf778e26725b04bcee8ca370880e523-c5bc015a9dbf7254-00",
  "errors": {
    "$": [
      "The input does not contain any JSON tokens. Expected the input to start with a valid JSON token, when isFinalBlock is true. Path: $ | LineNumber: 0 | BytePositionInLine: 0."
    ]
  }
}

{
  "type": "https://tools.ietf.org/html/rfc7231#section-6.5.1",
  "title": "One or more validation errors occurred.",
  "status": 400,
  "traceId": "00-8cf778e26725b04bcee8ca370880e523-c5bc015a9dbf7254-00",
  "errors": {
    "$": [
      "The input does not contain any JSON tokens. Expected the input to start with a valid JSON token, when isFinalBlock is true. Path: $ | LineNumber: 0 | BytePositionInLine: 0."
    ]
  }
}