Unable to read request body ( IdentityServer 4 ) - asp.net

Question

Hi I'm trying to read the Request body sent by React app with axios to Asp.net core app (IdentityServer 4) to get the token. The following code is from react app.
const headers = {
'Content-Type': 'application/json',
}
const data = {
'grant_type': 'password',
'client_id': '*********-****-****-****-************',
'client_secret': 'ClientSecret',
'username': 'user',
'password': 'password',
'scope': 'email',
'response_type': 'id_token'
}
axios.post('http://localhost:5000/connect/token', data, {
headers: headers
})
.then((response) => {
console.log(response)
})
.catch((error) => {
console.log(error)
})
IdentityServer code is as follows ( I have registered IHttpContextAccessor in startup.cs class )
namespace IdentityServer
{
public class CustomCorsPolicy : ICorsPolicyService
{
private readonly IHttpContextAccessor _httpContext;
public CustomCorsPolicy(IHttpContextAccessor httpContext)
{
_httpContext = httpContext; ----------> Trying to access request body here I want to get the clientId sent by react app in request body.
}
public Task<bool> IsOriginAllowedAsync(string origin)
{
return Task.FromResult(true);
}
}
}
When I try to debug to see the request body I'm getting the following data
Am I doing anything wrong here? If so can anyone help me to know How can I get the request body.

Answer 1

Your custom CustomCorsPolicy will only be called on CORS-related requests and that means only when you do AJAX-requests from your browser, for example when you call the UserInfo endpoint.
So, that means that your CustomCorsPolicy is never called as part of the normal authentication request process, only during AJAX-requests. during the first CORS preflight request to the /connect/userinfo endpoint (with the OPTIONS http request method/verb) there is NO token or clientID provided at all.
During the second request, you get the access token from the Authorization header. You could with some hard work get the clientID from the access token. The token is in the request headers, not request body (that is empty during both requests).
The first request looks like:
OPTIONS https://localhost:6001/connect/userinfo HTTP/1.1
Host: localhost:6001
Connection: keep-alive
Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://localhost:5001
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Sec-Fetch-Dest: empty
Referer: https://localhost:5001/ImplicitFlow/LoggedInUsingFragment
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
the second request to the-user info endpoint looks like this:
GET https://localhost:6001/connect/userinfo HTTP/1.1
Host: localhost:6001
Connection: keep-alive
Accept: */*
DNT: 1
Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjY1NzVBNTk1MkYwQUI3MTA3NzM2RDQ4RTY4REQwOTI2IiwidHlwIjoiYXQrand0In0.eyJuYmYiOjE1OTUzNTUxNDYsImV4cCI6MTU5NTM1ODc0NiwiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6NjAwMSIsImF1ZCI6WyJwYXltZW50IiwiaW52b2ljZSIsIm9yZGVyIiwiaHR0cHM6Ly9sb2NhbGhvc3Q6NjAwMS9yZXNvdXJjZXMiXSwiY2xpZW50X2lkIjoiaW1wbGljaXRmbG93Y2xpZW50Iiwic3ViIjoiVXNlcklEMTIzNDU2IiwiYXV0aF90aW1lIjoxNTk1MzU0ODk0LCJpZHAiOiJsb2NhbCIsInNlbmlvcml0eSI6IlNlbmlvciIsImNvbnRyYWN0b3IiOiJubyIsImVtcGxveWVlIjoieWVzIiwianRpIjoiMUY4NkE1NERBNzBBN0E1M0Q0RTRFOURCMUZFNTg5RDciLCJzaWQiOiIxRUMxNzAwREUxODZGOEFGRTc0MEQ3QTBGMjM1MDI1RCIsImlhdCI6MTU5NTM1NTE0Niwic2NvcGUiOlsib3BlbmlkIiwiZW1haWwiLCJwcm9maWxlIiwic2hvcC5hZG1pbiJdLCJhbXIiOlsicHdkIl19.Ey9e1OyVgm8ctrUmv9BlKsZburIHmKwEZc53EWu7H0dXg_DbgzPyIttq35wkGGrL6mbL9k4v9MPtwgvXP2iStR-9IMSEjXml9Wb0oFcAmlhWYSMW3bQ-64qUrgzwiDW6WFTcBAFR5q_cw-HEjYbLQzxhV5_6QuaJTfF15OpqxEk9074A-FaM7I-WvgTSMesqZCqupuYBmXPOxnTaII8ZMy1EnnOaDfT1dUUBIU1gB4H4waU_iUoX6u_nJrgXVlm9kYn0CkcV9qiVMlRCAg_t1q-nBjjRMZCrfa5hKgAdz2rzmjUpKGTCIU30RkryVDf845xMbcEiC6KZhPai_pPSmg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36
Origin: https://localhost:5001
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://localhost:5001/ImplicitFlow/LoggedInUsingFragment
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
But back to the initial question, I think you need to rethink what you try to achieve, beause the CORS service is only called on CORS-requests, after the client already have received their access-token. I think you can solve it much easier by creating different client definitions and ApiScopes for the different client and rights that you want to control.