Example of Hangfire authorization using token from navlink

[nbiada]

No description provided.

[unchase]

Is it safe to pass a token in a query string?

[nbiada]

The token is exposed in the header of any call, so is more or less the same as exposing it in the query string.

[gozilla-paradise]

Should it validate token before granting access? @nbiada

[fgilde]

I have done it like this
This method added to dashboard controller

 [Authorize(Policy = Permissions.Hangfire.View)]
        [HttpGet("jobdashboardurl")]
        [Produces(typeof(string))]
        public IActionResult GetJobDashBoardUrl()
        {
            HttpContext.Session.SetString(ApplicationConstants.Hangfire.SessionUserIdKey, Get<ICurrentUserService>().UserId);
            return Ok(ApplicationConstants.Hangfire.DashboardRoute);
        } 

Content of the authfilter

public class HangfireAuthorizationFilter : IDashboardAuthorizationFilter
    {

        public bool Authorize(DashboardContext context)
        {
            var httpContext = context.GetHttpContext();
            var service = httpContext.RequestServices.GetService<IAccountService>();
            
            var userId = httpContext.Session.GetString(ApplicationConstants.Hangfire.SessionUserIdKey);
            
            return !string.IsNullOrEmpty(userId) && service != null && service.AuthorizeAsync(userId, Permissions.Hangfire.View).Result;
        }
    }

and on client side onclick instead of href

private async void OpenJobDashboard()
    {
        var uri =await _api.Dashboard_GetJobDashBoardUrlAsync();
        _navigationManager.NavigateTo(uri, true);
    }