{"action":"created","issue":{"url":"https://api.github.com/repos/ServiceStack/Issues/issues/334","labels_url":"https://api.github.com/repos/ServiceStack/Issues/issues/334/labels{/name}","comments_url":"https://api.github.com/repos/ServiceStack/Issues/issues/334/comments","events_url":"https://api.github.com/repos/ServiceStack/Issues/issues/334/events","html_url":"https://github.com/ServiceStack/Issues/issues/334","id":100042625,"number":334,"title":"Problem with session cookies in HTTP Headers and querystring","user":{"login":"alistefano","id":9036316,"avatar_url":"https://avatars.githubusercontent.com/u/9036316?v=3","gravatar_id":"","url":"https://api.github.com/users/alistefano","html_url":"https://github.com/alistefano","followers_url":"https://api.github.com/users/alistefano/followers","following_url":"https://api.github.com/users/alistefano/following{/other_user}","gists_url":"https://api.github.com/users/alistefano/gists{/gist_id}","starred_url":"https://api.github.com/users/alistefano/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alistefano/subscriptions","organizations_url":"https://api.github.com/users/alistefano/orgs","repos_url":"https://api.github.com/users/alistefano/repos","events_url":"https://api.github.com/users/alistefano/events{/privacy}","received_events_url":"https://api.github.com/users/alistefano/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-08-10T11:38:44Z","updated_at":"2015-08-11T05:59:31Z","closed_at":"2015-08-10T18:30:08Z","body":"Hi,\r\nI am trying to authenticate users with session cookies in http headers or querystring, but the webservice sends always a 401 error.\r\n\r\nI ran a debug and I think that problem is in this function in SessionExtensions.cs\r\n\r\npublic static string GetSessionParam(this IRequest httpReq, string sessionKey)\r\n        {\r\n            return httpReq.GetItemOrCookie(sessionKey)\r\n                ?? httpReq.GetHeader(\"X-\" + sessionKey)\r\n                ?? (HostContext.Config.AllowSessionIdsInHttpParams\r\n                    ? (httpReq.QueryString[sessionKey] ?? httpReq.FormData[sessionKey])\r\n                    : null);\r\n        }\r\n\r\nbecause ServiceStack checks this sequence:\r\n1. Session Cookies\r\n2. Headers\r\n3. QueryString\r\n\r\nI found that if there are no cookies in the request, ServiceStack creates a new one before calling the function GetSessionParam.\r\nIf session cookies are available but invalid the authentication fails (the other two cases are never inspected).\r\n"},"comment":{"url":"https://api.github.com/repos/ServiceStack/Issues/issues/comments/129715964","html_url":"https://github.com/ServiceStack/Issues/issues/334#issuecomment-129715964","issue_url":"https://api.github.com/repos/ServiceStack/Issues/issues/334","id":129715964,"user":{"login":"mythz","id":89361,"avatar_url":"https://avatars.githubusercontent.com/u/89361?v=3","gravatar_id":"","url":"https://api.github.com/users/mythz","html_url":"https://github.com/mythz","followers_url":"https://api.github.com/users/mythz/followers","following_url":"https://api.github.com/users/mythz/following{/other_user}","gists_url":"https://api.github.com/users/mythz/gists{/gist_id}","starred_url":"https://api.github.com/users/mythz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mythz/subscriptions","organizations_url":"https://api.github.com/users/mythz/orgs","repos_url":"https://api.github.com/users/mythz/repos","events_url":"https://api.github.com/users/mythz/events{/privacy}","received_events_url":"https://api.github.com/users/mythz/received_events","type":"User","site_admin":false},"created_at":"2015-08-11T05:59:31Z","updated_at":"2015-08-11T05:59:31Z","body":"This should be solved with this commit: https://github.com/ServiceStack/ServiceStack/commit/8085bf3dba58c50fd5253bff7b5cf569d66a2918\r\n\r\nSee [Redownloading MyGet Packages](https://github.com/ServiceStack/ServiceStack/wiki/MyGet#redownloading-myget-packages) for instructions on how to download the latest v4.0.43 NuGet packages."}}