Ocelot WebSocketsProxyMiddleware does not handle 401 Authentication error and returns 500 Internal Server Error

[Julandia]

Our company plans to use Ocelot as API gateway for the company intranet services. We had below authentication problem when routing the SignalR requests using Ocelot. Is this a defect of Ocelot or do I miss some configuration?

Expected Behavior / New Feature

I expect that when server side returns 401 authentication, Ocelot should return the error to upstream

Actual Behavior / Motivation for New Feature

Ocelot return 500 Internal Server Error

Steps to Reproduce the Problem

1. Have SignalR client and service running. Both service and client use .NetFramework SignalR. The service uses .Net Framework Web API stack and implement authentication middleware.
2. Client sends a SignalR request to the service via Ocelot.
3. Ocelot does not handle 401 authentication error returned by service and throws 500 Internal Server Error during SignalR connection:

Error stack:
Exception has occurred: CLR/System.Net.WebSockets.WebSocketException
Exception thrown: 'System.Net.WebSockets.WebSocketException' in System.Private.CoreLib.dll: 'The server returned status code '401' when status code '101' was expected.'
at System.Net.WebSockets.WebSocketHandle.d__24.MoveNext()
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Net.WebSockets.ClientWebSocket.d__16.MoveNext()
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Ocelot.WebSockets.Middleware.WebSocketsProxyMiddleware.d__7.MoveNext() in C:\simhub\Ocelot\src\Ocelot\WebSockets\Middleware\WebSocketsProxyMiddleware.cs:line 118

Specifications

• Version: 16.0.1
• Platform:
• Subsystem:

[onahirniak]

The same issue.

[abdulmoizlogiciel]

any resolution or workaround please?
i have the same issue.

[raman-m]

Duplicate of #1040

[raman-m]

Hi @Julandia !

Our company plans to use Ocelot as API gateway for the company intranet services.

Does your company use Ocelot now?

---

We had below authentication problem when routing the SignalR requests using Ocelot.

I guess this is Authentication problem for ws sceme. Ocelot WebSockets pipeline has no Auth middlewares to process authenticated routes. See more details in #1040 please!

---

Is this a defect of Ocelot or do I miss some configuration?

Authentication is not implemented in Ocelot currently for WebSockets!
Well... I recommend one common life coding hack:

• Define anonymous route to Authentication endpoint to get auth artifacts like: token, cookie, session ID token
• Define authenticated route with attached auth artifact to be authenticated by downstream services successfully

Hope it helps!