ASP.NET Core 5.0 - The TempData Challenge

This article will describe the implementation of the TempData attribute to persist the challenge on the server between requests. The challenge is a unique code used by FIDO to verify the response from the authenticating device. I will assume you have downloaded the ASP.NET Core 5.0 - Users Without Passwords Project.

The Users Without Passwords Project's (UWPP) registration and login processes involve communication between the server, client-js, authenticator, and user. The server provides a unique code called a challenge to the client. The client transforms the challenge to a UInt8Array expected by the authenticator. The challenge and username are used to register or verify a public key with the authenticator. The client sends the response from the authenticator to the server. The response is decoded and verified. The response includes the challenge which is decoded to verify a match to the server's original code. If the response and challenge are verified the response is stored and action is implemented like create or login the user.

The challenge code must persist on the server between the initial request and the callback. An early prototype for UWPP implemented Application Session State but I found the Cookie TempDataProvider met my requirements and was easier to implement. See ASP.NET Core 3.1 - Round Trip Challenge.

Add the CookieTempDataProvider with options to the RazorPages service.

Startup.cs > ConfigureServices

services.AddRazorPages()
    .AddCookieTempDataProvider(options =>
    {
        options.Cookie.IsEssential = true;
        options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
    });

During research for this article, I found injecting the ITempDataProvider to the PageModel is redundant. The ITempDataProvider has two methods which return or save an IDictionary<string, object>.

Microsoft. AspNetCore. Mvc. ViewFeatures. ITempDataProvider:

//
// Summary:
//     Loads the temporary data.
//
// Parameters:
//   context:
//     The Microsoft.AspNetCore.Http.HttpContext.
//
// Returns:
//     The temporary data.
IDictionary<string, object> LoadTempData(HttpContext context);
//
// Summary:
//     Saves the temporary data.
//
// Parameters:
//   context:
//     The Microsoft.AspNetCore.Http.HttpContext.
//
//   values:
//     The values to save.
void SaveTempData(HttpContext context, IDictionary<string, object> values);

The PageModel implements an ITempDataDictionary named TempData.

Microsoft. AspNetCore. Mvc. RazorPages. PageModel:

// Summary:
//     Gets or sets Microsoft.AspNetCore.Mvc.ViewFeatures.ITempDataDictionary used by
//     Microsoft.AspNetCore.Mvc.RazorPages.PageResult.
public ITempDataDictionary TempData { get; set; }

The ITempDataDictionary inherits IDictionary and adds methods.

Microsoft. AspNetCore. Mvc. ViewFeatures. ITempDataDictionary:

//
// Summary:
//     Marks all keys in the dictionary for retention.
void Keep();
//
// Summary:
//     Marks the specified key in the dictionary for retention.
//
// Parameters:
//   key:
//     The key to retain in the dictionary.
void Keep(string key);
//
// Summary:
//     Loads the dictionary by using the registered Microsoft.AspNetCore.Mvc.ViewFeatures.ITempDataProvider.
void Load();
//
// Summary:
//     Returns an object that contains the element that is associated with the specified
//     key, without marking the key for deletion.
//
// Parameters:
//   key:
//     The key of the element to return.
//
// Returns:
//     An object that contains the element that is associated with the specified key.
object Peek(string key);
//
// Summary:
//     Saves the dictionary by using the registered Microsoft.AspNetCore.Mvc.ViewFeatures.ITempDataProvider.
void Save();

I updated the UWPP using the TempData attribute and functions rather than injecting the ITempDataProvider. I developed a couple of pages to demonstrate some of the TempData functions I use in the UWPP. The first page demonstrates the transfer of a of a user input (LoginName) to a second page. I implement the IDictionary key accessor because the TempData attribute overrides the BindProperty attribute on the LoginName property. The demo is included the UWPP and is published on fido.kenhaggerty.com at TempData Demo.

TempDataDemoP1.cs

public class TempDataDemoP1Model : PageModel
{
    [BindProperty]
    [Required]
    [Display(Name = "Login Name")]
    [StringLength(32, ErrorMessage = "The {0} must be at least {2} and at max {1} characters long.", MinimumLength = 6)]
    public string LoginNameInput { get; set; }

    public void OnGet()
    {
        TempData.Clear();
    }

    public IActionResult OnPost()
    {
        if (!ModelState.IsValid) return Page();

        TempData["LoginName"] = LoginName;

        return RedirectToPage("./TempDataDemoP2");
    }
}

The first callback matches but a second callback fails for TempData not found.