Authenticating with a JsonApiClient at a ServiceStack API with a CustomCredentialsAuthProvider

[boneskewer69]

I'm currently facing some problems authenticating at my ServiceStack server application. The client is a Blazor WebAssembly application. The project is structurally very similar to the recently updated Blazor Wasm Project Template as presented in the YouTube video on your channel.
I've implemented my own CredentialsAuthProvider. Authenticating using i.e. postman works like a charm. All of my projects are using the most recent version 6.0.2 of ServiceStack.

---

Inside the Blazor Wasm application I'm using the JsonApiClient to authenticate at my service as shown in this guide in your documentation using the Authenticate model and executing it with the ApiAsync method.
The request never makes it. Any other request does not work either. They all get stuck somewhere and inspecting the browser network debugging tab shows that there is no fetch or any other activity.
Using the standard HttpClient on the other hand, I can make requests and get a response as expected.

I tried debugging the ApiAsync method as good as possible but it can't gather many useful details.

1. First up, it always ends up populating the Error with TypeInitializationException and the ErrorMessage is The type initializer for 'ServiceStack.HttpUtils' threw an exception. In the ErrorSummary it says System.NullReferenceException. Needless to say, I don't get a Response object back.
2. When going through each step while debugging, I noticed that the url gets assembled to /api/Authenticate even though in the documentation it says to authenticate using HTTP with /auth/{{credentialsprovidername}}.

So I tried using the /api/Authenticate with Postman and populating the request as the JsonApiClient would. The response I get is a 404 Not Found.

I'm pretty sure somewhere in the docs it says not to use a custom Request object for authenticating. I made up my own object for debugging tho, trying to get the JsonApiClient to work somehow.

[Route("/auth", "POST")]
public class PostAuthRequest : IReturn<AuthenticateResponse>, IPost
{
    public string provider { get; set; } = string.Empty;
    public string UserName { get; set; } = string.Empty;
    public string Password { get; set; } = string.Empty;
    public bool RememberMe { get; set; } = false;
}

[Route("/auth/{{credentialsprovidername}}", "POST")]
public class PostCustomAuthRequest : IReturn<AuthenticateResponse>, IPost
{
    public string UserName { get; set; } = string.Empty;
    public string Password { get; set; } = string.Empty;
    public bool RememberMe { get; set; } = false;
}

I had no luck using the custom Request objects either. So away they go.

---

Right now, I would like to understand why the JsonApiClient does make a call to /api/Authenticate and not /auth/{{cresentialsprovidername}}.

---

Maybe it is an issue inside the Server application?

For example, I am using a prefix for all my routes with the HandlerFactoryPath set to api in order to avoid route issues with the Blazor Wasm application.

Maybe it has to do with the fact that I am using Kestrel builder.WebHost.UseKestrel() for the web host or that I am using the extension method builder.Host.UseWindowsService() (which should only affect the program while running as a service and not during development) for logging to the event log.

My custom auth implementation uses EF Core instead of OrmLite since EF Core is used in the project already and I don't want to use two different ORMs.

---

Currently, I'm also trying to recreate my issue in a separate repository.

[mythz]

The HttpUtils static initializer issue is solved with v6.0.3 on pre-release version on MyGet.

You can copy NuGet.config next to your .sln and do a full nuget restore to use the latest 6.0.3 NuGet packages.

Right now, I would like to understand why the JsonApiClient does make a call to /api/Authenticate and not /auth/{{cresentialsprovidername}}.

It's because the AuthDtos.cs which is all the client libraries has access to doesn't have any static user-defined routes as they're configurable server-side.

But using a custom DTO does use the user-defined routes, where:

var client = new JsonApiClient("http://example.org");
var response = client.Post(new PostAuthRequest
{
    provider = "credentials",
    UserName = "[email protected]",
    Password = "p@55wOrd",
    RememberMe = true,
});

Does send the request using the user-defined /auth route:

POST http://example.org/auth HTTP/1.1
Host: example.org
Accept: application/json
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=utf-8
Content-Length: 97

{"provider":"credentials","UserName":"[email protected]","Password":"p@55wOrd","RememberMe":true}

Also if your server doesn't have the /api pre-defined route then you should change the fallback to use the existing pre-defined route, which you can do globally with:

JsonApiClient.DefaultBasePath = "/json/reply";

Or per instance with:

var client = new JsonApiClient("http://example.org") {
    UseBasePath = "/json/reply"
};

[boneskewer69]

Thank you for your quick reply and the detailed insight! I'll try to get it working with 6.0.3 :D