Wsrtjtyk

Is it possible to check the IP adress when using System.IdentityModel.Tokens.Jwt in an ASP.NET core Web Api application?

I thought about adding a Claim containing the IP of the user that requested it and check it somehow for each request. Normally I would use OnActionExecuting in ASP.NET MVC.

Is there a Middleware/Authorization based solution?

I Create my Jwt Token Claims like this:

private IEnumerable<Claim> getStandardClaims(IdentityUser user)

{

    var claims = new List<Claim>

    {

        new Claim(ClaimTypes.Name, user.UserName),

        new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),

        new Claim(JwtRegisteredClaimNames.Sub, user.UserName),

        new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),

        new Claim("ipaddress", HttpContext.Connection.RemoteIpAddress.ToString())

    };



    return claims;

}

this is what the JWT Data look like:

{

  "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "username",

  "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "5a6b3eb8-ed7f-48c6-b10c-a279ffd4f7c8",

  "sub": "username",

  "jti": "44c95b53-bfba-4f33-b4c3-834127605432",

  "ipaddress": "::1",

  "exp": 1542707081,

  "iss": "https://localhost:5001/",

  "aud": "https://localhost:5001/"

}

Edit: Possible Solution for JWT Claims?
Maybe I have to read the Claims like this (Test code, no null checks ect..):

var auth = HttpContext.Request.Headers.FirstOrDefault(x => x.Key == "Authorization");

string token = auth.Value[0].Split(' ')[1];



JwtTokenService<RefreshToken, string> jwtService = new JwtTokenService<RefreshToken, string>(null);

var principal = jwtService.GetPrincipalFromExpiredToken(token, _config["Jwt:Key"]);



Claim ipClaim = principal.FindFirst(claim => claim.Type == "ipaddress");

This is the GetPrincipalFromExpiredToken Method:

public ClaimsPrincipal GetPrincipalFromExpiredToken(string token, string securityKey)

{

    var tokenValidationParameters = new TokenValidationParameters

    {

        ValidateAudience = false, 

        ValidateIssuer = false,

        ValidateIssuerSigningKey = true,

        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(securityKey)),

        ValidateLifetime = false 

    };



    var tokenHandler = new JwtSecurityTokenHandler();

    SecurityToken securityToken;

    var principal = tokenHandler.ValidateToken(token, tokenValidationParameters, out securityToken);

    var jwtSecurityToken = securityToken as JwtSecurityToken;

    if (jwtSecurityToken == null || !jwtSecurityToken.Header.Alg.Equals(SecurityAlgorithms.HmacSha256, StringComparison.InvariantCultureIgnoreCase))

        throw new SecurityTokenException("Invalid token");



    return principal;

}

You can do that (and all other authorization stuff) via Policy-based authorization.

public class IpCheckRequirement : IAuthorizationRequirement

{

    public bool IpClaimRequired { get; set; } = true;

}



public class IpCheckHandler : AuthorizationHandler<IpCheckRequirement>

{

    public IpCheckHandler(IHttpContextAccessor httpContextAccessor)

    {

        HttpContextAccessor = httpContextAccessor ?? throw new ArgumentNullException(nameof(httpContextAccessor));

    }



    private IHttpContextAccessor HttpContextAccessor { get; }

    private HttpContext HttpContext => HttpContextAccessor.HttpContext;





    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, IpCheckRequirement requirement)

    {

        Claim ipClaim = context.User.FindFirst(claim => claim.Type == "ipaddress");



        // No claim existing set and and its configured as optional so skip the check

        if(ipClaim == null && !requirement.IpClaimRequired)

        {

            // Optional claims (IsClaimRequired=false and no "ipaddress" in the claims principal) won't call context.Fail()

            // This allows next Handle to succeed. If we call Fail() the access will be denied, even if handlers

            // evaluated after this one do succeed

            return Task.CompletedTask;

        }



        if (ipClaim.Value = HttpContext.Connection.RemoteIpAddress?.ToString())

        {

            context.Succeed(requirement);

        }

        else

        {

            // Only call fail, to guarantee a failure, even if further handlers may succeed

            context.Fail();

        }



        return Task.CompletedTask;

    }

}

then add

services.AddSingleton<IAuthorizationHandler, IpCheckHandler>();

services.AddAuthorization(options =>

{

    options.AddPolicy("SameIpPolicy",

        policy => policy.Requirements.Add(new IpCheckRequirement { IpClaimRequired = true }));

});

to your ConfigureServices method.

Now you can annote the controllers on which you want to apply it with [Authroize(Policy = "SameIpPolicy")] or add a global policy:

services.AddMvc(options =>

{

    options.Filters.Add(new AuthorizeFilter("SameIpPolicy"))

})