Securing WebSharper remote calls

Question

Quoting from the WebSharper 2.5 alpah docs the remoting component assumes that:

RPC-callable methods are safe to call from the web by an unauthenticated client.

Is there anyway to secure remote calls so they can only be called from an authenticated client?

score 5 · Answer 1 · answered Oct 27 '13 at 15:48

One of the samples in the WebSharper website is a chat application that seems to do just that by providing a Login method that returns an authentication token, which is then required to call the other functions:

[<Rpc>]
let Login (user: string) : Option<Auth.Token> =
    let s = State.Get()
    if s.Users.ContainsKey user then
        None
    else
        // (snip)
        user |> Auth.Generate |> Some

[<Rpc>]
let Poll (auth: Auth.Token) (time: int) =
    // (snip)

The full chat sample can be found here: http://www.websharper.com/samples/Chat

score 2 · Answer 2 · answered Nov 07 '13 at 05:12

Just been playing with this myself. Turns out if you're using Forms Authentication you can read the current HTTPContext from inside RPC methods so you can do something like this:

[<Rpc>]
let protectedMethod () =
  match IntelliFactory.WebSharper.Sitelets.UserSession.GetLoggedInUser() with
  | Some(username) ->
    // User is authenticated... do stuff
    ()
  | None -> failwith "Authentication failed"

Securing WebSharper remote calls

2 Answers2