在受WIF（PassiveAuthentication）保护的MVC应用程序中，使用ajax请求加载部分视图

Question

I am developing an MVC4 application secured with Windows Identity Foundation.

I am also using jQuery ( $.ajax() ) to refresh some partial views at regular intervals.

This application is used for monitoring some systems and no navigation occurs apart from the partial view refreshes.

After 20 minutes the WIF security cookie expires and my application tries to request another token from the PassiveSTS page. As expected, the PassiveSTS performs authentication and redirects to the calling URL.

The problem is that the ajax() request used to load the partial view expects an HTTP 200 code and receives HTTP 302 instead.

It seems to me that Passive authentication is not designed to work properly with ajax calls to partial views.

What is wrong with this approach? Is an active authentication more appropriate?

Answer 1

Ajax calls should issue 401 if the caller is not authorized. The problem is that WIF assumes the request is a browser and does the redirect. I built a helper to suppress these redirects for Ajax calls in Thinktecture IdentityModel. You can either use the library from NuGet or just grab the relevant code and add it to your project.

http://brockallen.com/2013/02/19/suppress-login-redirects-for-api-clients-in-wif-with-thinktecture-identitymodel/

https://github.com/thinktecture/Thinktecture.IdentityModel.45/

Of course your client side JS would then have to do something when it gets the 401, but presumably you'd inform the use that you need to log back in.

Another thing might be to use sliding sessions, yet another feature I added to IdentityModel:

http://brockallen.com/2013/02/17/sliding-sessions-in-wif-with-the-session-authentication-module-sam-and-thinktecture-identitymodel/