ASP.NET API Gateway strange behavior - asp.net

Question

I am using ASP.NET Microservices plus a separate Ocelot API Gateway which serves for authentication/ authorization and rerouting.
This is my config file:
{
"Routes": [
// *** User API ***
{
"UpstreamPathTemplate": "/User/{id}",
"UpstreamHttpMethod": [ "Get"],
"DownstreamScheme": "https",
"DownstreamHostAndPorts": [
{
"Host": "localhost",
"Port": 7268
}
],
"DownstreamPathTemplate": "/api/User/{id}",
"DownstreamHttpMethod": "Get",
"AuthenticationOptions": {
"AuthenticationProviderKey": "Bearer",
"AllowedScopes": [
"Cart.API",
"Catalogue.API",
"Identity.API",
"offline_access"
]
},
"RouteClaimsRequirement": {
"Administrator": "true"
}
},
{
"UpstreamPathTemplate": "/User/{id}",
"UpstreamHttpMethod": [ "Put" ],
"DownstreamScheme": "https",
"DownstreamHostAndPorts": [
{
"Host": "localhost",
"Port": 7268
}
],
"DownstreamPathTemplate": "/api/User/{id}",
"DownstreamHttpMethod": "Put",
"AuthenticationOptions": {
"AuthenticationProviderKey": "Bearer",
"AllowedScopes": [
"Cart.API",
"Catalogue.API",
"Identity.API",
"offline_access"
]
},
"RouteClaimsRequirement": {
"Administrator": "true"
}
},
{
"UpstreamPathTemplate": "/User/{id}",
"UpstreamHttpMethod": [ "Delete" ],
"DownstreamScheme": "https",
"DownstreamHostAndPorts": [
{
"Host": "localhost",
"Port": 7268
}
],
"DownstreamPathTemplate": "/api/User/{id}",
"DownstreamHttpMethod": "Delete",
"AuthenticationOptions": {
"AuthenticationProviderKey": "Bearer",
"AllowedScopes": [
"Cart.API",
"Catalogue.API",
"Identity.API",
"offline_access"
]
},
"RouteClaimsRequirement": {
"Administrator": "true"
}
},
//edit,get logged user
{
"UpstreamPathTemplate": "/User/LoggedUser",
"UpstreamHttpMethod": [ "Put" ],
"DownstreamScheme": "https",
"DownstreamHostAndPorts": [
{
"Host": "localhost",
"Port": 7268
}
],
"DownstreamPathTemplate": "/api/User/LoggedUser",
"DownstreamHttpMethod": "Put",
"AuthenticationOptions": {
"AuthenticationProviderKey": "Bearer",
"AllowedScopes": [
"Cart.API",
"Catalogue.API",
"Identity.API",
"offline_access"
]
}
},
{
"UpstreamPathTemplate": "/User/LoggedUser",
"UpstreamHttpMethod": [ "Get" ],
"DownstreamScheme": "https",
"DownstreamHostAndPorts": [
{
"Host": "localhost",
"Port": 7268
}
],
"DownstreamPathTemplate": "/api/User/LoggedUser",
"DownstreamHttpMethod": "Get",
"AuthenticationOptions": {
"AuthenticationProviderKey": "Bearer",
"AllowedScopes": [
"Cart.API",
"Catalogue.API",
"Identity.API",
"offline_access"
]
}
}
//edit,get logged user
],
"GlobalConfiguration": {
"BaseUrl": "https://localhost:7193"
}
}
Now here is the problem.
I have the endpoint [GET] /User/LoggedUser (at the bottom) and it is configured without any authorization and it calls /api/User/LoggedUser.
I also have the endpoint [GET] /User/{id} and it is configured WITH authorization and it calls /api/User/{id}
If I use the current configuration as a whole and try calling [GET] /User/LoggedUser with authenticated user, but without the claim Administrator : true -> ** it does not work**
If I delete the rerouting for [GET] /User/{id}, which as you can see, is a totally separate endpoint rerouting - the above problem disappears.
It is as if Ocelot treats these 2 endpoints as one. But I do not understand why.
And here is the console log:
The problem is only with these 2 endpoints. If I call [PUT] /User/LoggedUser it does not work until I delete [PUT] /User/{id} .No other problems were detected. At least for now.
Update 1
So I renamed my API endpoints from /api/User/LoggedUser to be /LoggedUser (downstream path), changed my upstream path to /Test/LoggedUser and it worked.
So, clearly it is an url conflict. How should I handle such problem?
Update 2
Again, I changed the endpoints to the following:
{
"UpstreamPathTemplate": "/Get/LoggedUser",
"UpstreamHttpMethod": [ "Get" ],
"DownstreamScheme": "https",
"DownstreamHostAndPorts": [
{
"Host": "localhost",
"Port": 7268
}
],
"DownstreamPathTemplate": "/api/User/Get/LoggedUser",
"DownstreamHttpMethod": "Get",
"AuthenticationOptions": {
"AuthenticationProviderKey": "Bearer",
"AllowedScopes": [
"Cart.API",
"Catalogue.API",
"Identity.API",
"offline_access"
]
}
},
{
"UpstreamPathTemplate": "/Edit/LoggedUser",
"UpstreamHttpMethod": [ "Put" ],
"DownstreamScheme": "https",
"DownstreamHostAndPorts": [
{
"Host": "localhost",
"Port": 7268
}
],
"DownstreamPathTemplate": "/api/User/Edit/LoggedUser",
"DownstreamHttpMethod": "Put",
"AuthenticationOptions": {
"AuthenticationProviderKey": "Bearer",
"AllowedScopes": [
"Cart.API",
"Catalogue.API",
"Identity.API",
"offline_access"
]
}
}
And still, there is conflict.
Update 3
I have other endpoints which are overlapping to some extend. For example:
{
"UpstreamPathTemplate": "/User/Login",
"UpstreamHttpMethod": [ "Post" ],
"DownstreamScheme": "https",
"DownstreamHostAndPorts": [
{
"Host": "localhost",
"Port": 7268
}
],
"DownstreamPathTemplate": "/api/User/Login",
"DownstreamHttpMethod": "Post"
},
{
"UpstreamPathTemplate": "/User/Register",
"UpstreamHttpMethod": [ "Post" ],
"DownstreamScheme": "https",
"DownstreamHostAndPorts": [
{
"Host": "localhost",
"Port": 7268
}
],
"DownstreamPathTemplate": "/api/User/Register",
"DownstreamHttpMethod": "Post"
}
Yet, no problem with these endpoints. They are both POST, they both start with api/User and /User. I do not see what is the problem with the other endpoints.

Answer 1

I think the problem should be fixed from the routing configuration of the backend api, rather than the ocelot configuration. You should configure the default routes order (precedence) from specific to generic. In the above case /api/User/LoggedUser should be matched before /api/User/{id}. Take a look at this article for some more info about routing precedence in asp.net mvc and web.api.