API Key Authentication in Serenity - Working in v3.15 but Not in v8.6 (.NET 8)

[ademc]

I'm currently maintaining two Serenity applications - an older one running on ASP.NET 4.x with Serenity v3.15 and a newer one on .NET 8 with Serenity v8.6.

I need to implement API Key authentication for specific endpoints in both applications. I've successfully implemented this in the older application, but I'm struggling to get a similar solution working in the newer .NET 8 version.

Working solution for Serenity v3.15 (ASP.NET 4.x)

I've implemented the following authentication filter that works perfectly:

public class ApiKeyAuthFilter : IAuthenticationFilter
{
    private static readonly HashSet<string> ApiKeyEnabledPaths = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
    {
        "/Services/MyModule/MyEndpoint/MyMethod"
    };

    public void OnAuthentication(AuthenticationContext context)
    {
        var path = HttpContext.Current.Request.Path;

        if (!ApiKeyEnabledPaths.Contains(path))
            return;

        var apiKey = HttpContext.Current.Request.Headers["X-API-Key"];
        var configApiKey = ConfigurationManager.AppSettings["ApiKey"];

        if (apiKey == configApiKey)
        {
            var identity = new GenericIdentity("admin");
            var principal = new GenericPrincipal(identity, null);

            context.Principal = principal;
            return;
        }
    }

    public void OnAuthenticationChallenge(AuthenticationChallengeContext context)
    {
    }
}

And registered it like this:

public class FilterConfig
{
    public static void RegisterGlobalFilters(GlobalFilterCollection filters)
    {
        filters.Add(new HandleErrorAttribute());
        filters.Add(new ApiKeyAuthFilter());
    }
}

This approach allows me to bypass Serenity's cookie-based authentication for specific API endpoints when a valid API key is provided in the X-API-Key header.

Attempted solutions for Serenity v8.6 (.NET 8)

I've tried several approaches in the newer .NET 8 version:

1. Creating a custom ApiKeyAuthenticationHandler inheriting from AuthenticationHandler<AuthenticationSchemeOptions> and registering it in Program.cs
2. Using policy-based authorization with a custom AllowApiKeyAttribute
3. Implementing middleware that checks for API keys before the request pipeline

None of these approaches seem to be working with Serenity's authentication mechanism in v8.6. Either the API key is ignored, or I encounter issues with the authentication pipeline.

Questions

1. What's the recommended approach for implementing API key authentication alongside cookie authentication in Serenity v8.6 on .NET 8?
2. Is there a way to replicate the simple behavior I had in v3.15?
3. Are there specific considerations for the authentication pipeline in newer Serenity versions?

Any guidance would be much appreciated as I need to expose these endpoints to external systems that can't use cookie-based authentication.

[ademc]

@volkanceylan @VictorTomaili what do you thing? Is there any solution?

[VictorTomaili]

https://serenity.is/docs/startsharp/features/openid-integration

We offer an OpenIddict implementation complete with token authentication exclusively for Startsharp customers. If you need token authentication, you’ll have to either build your own solution or purchase Startsharp. Sharing our implementation would mean giving away our proprietary source code for free, which isn’t an option.