Since lesson 2.13.1 the Kladde has a hub, and signed-in people see new bookings right away. Above the hub there is a single [Authorize]. In this lesson you look more closely: What does the attribute check, and what doesn't it? Who may join which group? What happens when someone sends the hub a huge message or opens a hundred tabs? And how does a test prove all of that without someone laying two browser windows side by side?

A hub is an endpoint like any other: what a client sends it is foreign input (lesson 2.6.6). It gets the same care as the API, just at different places.

What [Authorize] checks on the hub

[Authorize] above the hub's class works at the door. MapHub creates two endpoints, /hubs/appointments/negotiate and /hubs/appointments, and gives both the attribute. Whoever isn't signed in gets a 401 at the very first step, the POST to negotiate. Since .NET 10, cookie sign-in no longer redirects such endpoints to the sign-in page (lesson 2.6.1); the client sees the 401 and reports it as an error.

There are three things the attribute does not check:

  • What the person may do later. SignalR reads the user once, when the connection is set up, and holds on to it for the connection's whole lifetime. If management takes a role away from a colleague at noon today, that person's open tab keeps the old role until the connection ends. This holds for cookies and tokens alike, and for long polling too, even though there every request is signed in anew. Microsoft names two ways out: close connections so that they sign in again (for tokens with an expiry there is the option CloseOnAuthenticationExpiration on MapHub), or check against the current state in a method that matters. For the Kladde it is enough to know this: your roles rarely change, and a page reload sets up the connection again.
  • Individual methods. [Authorize] above the class applies to the connection. A method can get a rule of its own, say [Authorize(Policy = KladdePolicies.Management)] above it, just like an endpoint of the API.
  • What a method does with its arguments. A hub that lets every client join any group is open to all signed-in people despite [Authorize]. That is what comes next.