Does anyone know how to add an intercepter after the authentication feature? Need it for an custom ...

# ktor

[bram93]

Does anyone know how to add an intercepter after the authentication feature? Need it for an custom Authorization feature

[Uriel Salischiker]

I made a custom authentication provider for that

[Uriel Salischiker]

but not sure its the best solution

[bram93]

Could you share an example?

[Uriel Salischiker]

Untitled_kt.kt

Untitled_kt.kt

[Uriel Salischiker]

based on the BasicAuthenticationProvider

[Uriel Salischiker]

but for reading the info from a cookie

[Uriel Salischiker]

example_kt.kt

example_kt.kt

[Uriel Salischiker]

and thats the usage code

[bram93]

thx

[bram93]

I ended up modifying the pricipal in the validate function:

install(Authentication) {
        jwt {
            verifier(jwkProvider, jwkIssuer)
            realm = jwkRealm
            validate { credentials ->
                if (credentials.payload.audience.contains(jwkAudience)) {
                    val account = httpClient.get<Account>(accountEndpoint) {
                        header("Authorization", request.header("Authorization"))
                    }

                    KKPrincipal(credentials.payload, account)
                } else null
            }
        }
    }

[Sergey Akhapkin]

@Uriel Salischiker why not to use Sessions plus Authentication features to have cookie auth out-of-box:

install(Sessions) {
    cookie<CookieClass>("CookieName") {
        // configure cookie provider: path, httpOnly, secure and so on
    }
}

install(Authentication) {
    session<CookieClass>("AuthorizationName") {
        challenge {
            appendWWWAuthenticateHeader(call)
            call.respond(HttpStatusCode.Unauthorized)
        }
        validate {
            // it here points to you CookieClass - extract data and may be call db to find user 
        }
    }
}

[Uriel Salischiker]

Ohh, tgat works when the cookie is not a session cookie but contains a url encoded string which then contains a access token?

[Uriel Salischiker]

@Sergey Akhapkin

[Sergey Akhapkin]

I don't sure I completely understood your question, but I don't see any restrictions to a content of cookie. When cookie provider is configured, you need to provide serialize/deserialize methods from/to CookieClass to/from String.

fun CookieSessionBuilder<CookieClass>.init() {
    ...
    serializer = object : SessionSerializer {
        override fun deserialize(text: String): Any = ...
        override fun serialize(session: Any): String = ...
    }
}