User Information in Nancy

Question

I am crashing a demo application based on Nancy.Demo.Authentication.Forms .

I implement Claims and UserName in my UserIdentity:IUserIdentity and, according to the demo, I have a UserModel with UserName .

In the SecureModule class SecureModule I can see that Context.CurrentUser can be used to find out who it is registered in, but according to the interface it only indicates the username and formula. If then I need to get more data (for example, messages for user login) for the view model, all I can use to filter as a db request is a username that feels, well, weird. I would prefer to use a unique user id.

I think I'm trying to figure out if it is better to add additional fields to my IUserIdentity implementation or to UserModel ? And where to fill them?

I'm not sure my question is what is clear (it is not clear in my head!), But some general recommendations on the basic architecture will go crazy.

Answer 1

Sorry for the delayed answer .. a bit fussy at the moment :)

IUserIdentity is the minimum interface required to use the Nancy built-in authentication assistants, you can implement this and add as much additional information as you want to your class; It is similar to the .net IPrincipal standard. If you add your own information, you will obviously have to give your implementation type access to additional fields. We could add the CurrentUser method so you don't do this, but it seems a little redundant.

You can stop reading here if you want, or you can read if you are interested in how auth forms work.

FormsAuth uses the IUsernameMapper implementation (which is probably not specified correctly now) to convert between the Guid user ID stored in the client cookie and the actual user (IUserIdentity). It’s worth noting that this GUID should be mapped to the username / id somewhere, but it is not intended for your primary database key, it’s just a layer of indirection between your (possibly predictable) identifier / username and “token”, stored on the client. Although cookies are encrypted and HMACd (depending on your configuration), if someone can really crack and restore the auth cookie, they will have to guess someone else's GUID to impersonate them, instead of changing the username ( to "admin") or something similar), or id (up to 1 for the first user).

Hope this makes sense :)