0

My Durandal SPA app performs BASIC authentication to acquire a session token which it then presents in headers to access Web API controller methods. This works fine.

On successful authentication I cache the access_token in localStorage so I can re-acquire it from local storage to preserve the session in the event of browser closure or refresh. The token is re-acquired but it is rejected by the server with an Unauthorized message.

This question starts by saying that the OP has successfully done what I am trying to do, so it's certainly possible, but the code he shows is a sample of (unsuccessfully) trying to do cookie mapping and I can't divine the nature of my problem from it.

One of the answers to this question says

Fortunately, WIF has a way to mitigate [replay attacks]. By configuring:

<identityConfiguration>
  .......
  <tokenReplayDetection enabled="true" />
  .....
</identityConfiguration>

I do in fact have WIF installed on my development workstation, but I wouldn't know where to start looking for this setting. A search of my HDD found "tokenReplayDetection" in 17 System.IdentityModel related DLLs, but not in any config files.

Does anyone think this is in fact the problem and if so where does it live? Any other thoughts also gratefully received.

Community
  • 1
  • 1
Peter Wone
  • 17,965
  • 12
  • 82
  • 134
  • I don't know the answer, but I'm in the process of researching this myself. Take a look at this post: http://stackoverflow.com/a/14658899/3174746. Vittorio Bertocci is the go-to guy for WIF. I remembered that from one of his videos. As soon as the poster mentioned Dominick Baier, I thought of Bertocci. They travel together, so to speak, and wrote a book together. –  Jan 01 '15 at 17:32
  • Rather embarrassingly it appears that there was a bug in my token retrieval causing it to occur *after* the first attempt to perform an authenticated Web API request, and everything is now hunky dory. But the question of where that setting lives remains: silly bug notwithstanding I still need to know, just not so urgently :) – Peter Wone Jan 02 '15 at 06:33
  • Sorry Peter just noticed this today, too late but glad you got it working! – Ibraheem Feb 26 '15 at 19:24

0 Answers0