0

We have an MVC/AngularJS system with a Web API back-end that uses Azure ACS and AAD to authenticate our users. The authentication works well, and when the user first authenticates the claims from ACS are passed in in the token.

We override the ClaimsPrincipal Authenticate method and verify that this user is a user of our system and add role claims here too.

After this the user is directed to the home page and the next step of the process requires the user to select an item from a list (e.g. their current location).

This selection determines how certain settings are applied in the web application. When the user makes this selection we make an ajax call to the Web Api back-end and here we add another three claims to the token, reflecting the user's selection.

Now if I refresh the page after this selection has been made the whole process starts again, but different browsers behave differently.

For Chrome and Opera the 'ClaimsPrincipal Authenticate' is called again, the roles are added again and the user need to make the selection again to add the three claims (i.e. when the page is refreshed a copy of the token before our code modified it is used).

For Firefox and IE the refresh passes in a token with all the claims that we added programatically, so it didn't revert the token to the initial state.

The latter behaviour is what I would have expected and what I would prefer. Is there any documentation on this, and for Chrome and Opera is there a way to ensure the current token is used when the page is refreshed?

Neil
  • 2,659
  • 7
  • 35
  • 57
  • Is there a domain name difference between Your Web site and Your WebApi? For what address is the cookie with token returned by WebApi issued? You may want to look at [this](http://stackoverflow.com/questions/1062963/how-do-browser-cookie-domains-work) – Grzegorz W Feb 15 '14 at 20:44
  • No the website and Web Api are on the same domain. – Neil Feb 17 '14 at 10:20
  • Does Your `SessionSecurityToken` work well on all browsers if You use only Ajax calls? Or is browser refresh a required functionality? – Grzegorz W Feb 19 '14 at 20:13
  • No it is not required at all, the page should never change. We use AngularJS routing to simulate the page changes. However if a user does refresh the browser I would like to be able to pick up the user's selected location from the claims I previously added to the token (after the initial page load). Firefox and IE have those claims on the token when the page is refreshed, Chrome and Opera revert the token to it's initial state when the page is refreshed. I am just curious why, and if it is documented anywhere – Neil Feb 20 '14 at 08:49

0 Answers0