Read Custom request Header in OWIN Authentication - ajax

Question

I am trying to provide extra/custom authentication to MS Bot-framework project using OWIN other than default authentication from MS using app id/pwd. Yes the Bot is in-fact an api i tagged Webapi too. I added OWIN startup class and provided middleware to perform OAUTH-2 implementation to validate JWT.
As MS Bot directline calls have a default Bearer token to be passed as Authorization header key,i given custom provider to accept JWT from Bot state. Please note my bot is surfaced in a Web app which will generate a auth token which will be setted in Bot state against unique user id, so i am in need of this user id value to retrieve the token from Bot state. So the best possible way i can think of is to intercept all ajax calls from my Webchat Bot control to add a custom header as "x-user-id", which i will read from my owin middleware request header.
But it was not succeeding as i am not getting the header value in OWIN, which i am passing in ajax calls. But when i checked in Chrome, this header is being sent. I am confused on what could be the issue.
Ajax Interceptor
if (window.XMLHttpRequest && !(window.ActiveXObject)) {
(function (send) {
XMLHttpRequest.prototype.send = function (data) {
this.setRequestHeader('x-user-id', '123456789');
send.call(this, data);
};
})(XMLHttpRequest.prototype.send);
}
AppBuilder Configuration
public void Configuration(IAppBuilder app)
{
var policy = new CorsPolicy()
{
AllowAnyHeader = true,
AllowAnyMethod = true,
AllowAnyOrigin = true,
SupportsCredentials = true
};
policy.ExposedHeaders.Add("x-user-id");
app.UseCors(new CorsOptions()
{
PolicyProvider = new CorsPolicyProvider
{
PolicyResolver = context => Task.FromResult(policy)
}
});
app.Map("/api", ctx =>
{
ctx.UseEsoAccessTokenValidation(new EsoAccessTokenOptions
{
AccessTokenKey = "AccessToken",
ChannelId = "webchat",
Scopes = new string[] { "read", "write" }
});
ctx.UseWebApi(WebApiConfig.Register());
});
}
Code to Read Header:
private static async Task<string> GetAccessToken(OAuthRequestTokenContext context, EsoAccessTokenOptions options)
{
string accesstoken = string.Empty;
var request = context.Request;
if (request.Headers.ContainsKey("x-user-id"))
{
userid = request.Headers.Get("x-user-id");
}
}
Chrome Network Screenshot
Please help me understand what i am doing wrong here?

Answer 1

Need to realize that, the requests always pass through the corresponding channels (connectors) and not everything that you add as part of headers will be passed to your bot. Hence we need to pass such data only through supported mechanisms. as Eric mentioned, once such way is leveraging channelData. Anything that you add as part of channelData will pass thru the channel and reach the bot. Hence recommend you to try the same.
Example 1:
{
"type": "conversationUpdate",
"membersAdded": [],
"from": {
"id": "test",
"name": "test"
},
"serviceUrl": "https://directline.botframework.com",
"channelData":{ "userId": "test"}
}
Example 2:
{
"type": "message",
"text": "whats your name",
"from": {
"id": "user1",
"name": "user1"
},
"channelData": {
"userId": "test1234"
}
}`
Hope this helps.

Answer 2

I think the Direct Line strips headers as it translates and transfers messages to your bot. However, you could intercept all messages (like you've done already) and add the x-user-id as custom channel data to each message. Here is an example of custom channel data: https://blog.botframework.com/2017/03/28/Custom-Channel-Data#c-implementation