Authentication in .net 7 using supabase auth

[rozzrr]

i am struggling to implement a solution using supabase auth for authentication in my .net api. i can swap providers and it works fine with validating the token and being able to verify its issuer. but when i try with supabase i get the following error in the stack :

IDX20803: Unable to obtain configuration from: 'https://{my-url}.supabase.co/auth/v1/authorize/.well-known/openid-configuration'

am i missing something simple here that i need to configure in the supabase dashboard?

this is my program.cs add auth method :

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.RequireHttpsMetadata = false;
        options.Authority = url + "/auth/v1/authorize";
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidIssuer = url + "/auth/v1/authorize",
            ValidateAudience = false,
            ValidateLifetime = true
        };
    });

any guidance would be vastly appreciated, been stuck a while trying to get this working.

[acupofjose]

Sorry for the delay - Have you tried doing something like what is mentioned here with an AuthenticationStateProvider? You shouldn't need to request the JWT from supabase yourself using their openid-configuration and everything. That would be handled by the gotrue library!

[rozzrr]

Thanks for the reply 👍😁

The thing about that approach is that my backend api doesn’t have access to the user auth side which is handled in the nextjs application in the front end; so I don’t think using authentication state provider will do the trick; unless I’m missing something?!

My solution, in principle is to validate the token which is sent to the api and through middleware validate the token and verify it’s correct before gaining access to the backend services.

This way I can keep the session, user auth to the front end and then use the access token generated by supabase across all backend services.

Authentication systems aren’t my
Strong suit so it’s still very much a topic I’m developing on, so any help is very much appreciated 👍

[acupofjose]

Ah! I see - you can verify a user given their JWT using the gotrue client's Supabase.Auth.GetUser(string jwt) signature.

That ought to be enough for you to keep track of an internal state in your middleware!

[rozzrr]

Thanks!
So when using this way, I’m not sure if you know or not so apologies in advance…
But would that be possible to integrate with the current .bet authentication so I can use the .authorise() on api calls?

[wiverson]

FWIW for server-side only stuff (e.g. I'm building a REST API only) I use the supabase.js client and then put the session JWT from Supabase in a cookie or header (e.g. Authorization). Then I just use a standard JWT decoder along with the secret key from my Supabase project.

I took a look at these docs here:

https://learn.microsoft.com/en-us/aspnet/core/security/authentication/?view=aspnetcore-7.0

...and it looks like as long as you put the Supabase session JWT into an Authorization request header you can you use this class:

https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.jwtbearerextensions.addjwtbearer?view=aspnetcore-7.0

...to add the auth.

The configuration for this does look a bit complicated (reminds me a lot of Spring Security). Good luck and report what you find!

[nove1398]

I am actually interested in your implementation of auth with .Net 7 api, is your project open on GitHub? I would love to check it out.

[rozzrr]

Just have some tweaks to make following the previous answers, but once I have a working implementation I can open source it to share 👍 will update this thread when live

[nove1398]

Awesome, been trying to figure some stuff out myself but need a bit of help to ensure I am on the right track. Looking forward to seeing your project.