How to resolve the image rendering and exporting issue with ASP.NET Core Authentication middleware

To fix image rendering and exporting with ASP.NET Core Authentication middleware in Bold Reports®, ignore authentication for the GetResource and PostFormReportAction methods with the [AllowAnonymous] attribute. You cannot add authentication to export and image rendering requests from the Report Viewer and Report Designer.

Ignoring authentication for the GetResource and PostFormReportAction requests does not cause a security issue. The Report Viewer and Report Designer use these requests, as the framework suggests, to retrieve file content from the server. The requests improve download usability and avoid delays when rendering images in reports.

The requests run only during export and image rendering, and others cannot use them again. The approach is similar to how Amazon Simple Storage Service (Amazon S3) gives access to share private files.

The implementation works in the following steps:

  1. Before initiating a non-authentication request, we will send the authenticate request to the server to generate the export and image content.
  2. The authenticated request will generate the exported with a unique server for the downloadable content and unique id will be shared with the client once the content is ready.
  3. After completing the process of generation, we will get the runtime unique key generated from the client and we will do the non-authentication request post action from the client with a unique key to the content for download and image rendering.
  4. Once the content revival initiated with the server, we could not make use of this URL again to get the generated content once again from the server because the files will be deleted with the server after initiating the action.

The following code uses the [AllowAnonymous] attribute. You can also download the ASP.NET Core basic authentication sample.

[Authorize]
    [Route("api/[controller]/[action]/{id?}")]
    public class ReportApiController : ControllerBase, IReportController
    {
        …….
        …….

        [ActionName("GetResource")]
        [AcceptVerbs("GET")]
        [AllowAnonymous]
        public object GetResource(ReportResource resource)
        {
            return ReportHelper.GetResource(resource, this, _cache);
        }

        [HttpPost]
        [AllowAnonymous]
        public object PostFormReportAction()
        {
            return ReportHelper.ProcessReport(null, this, this._cache);
        }

        …….
        …….
    }

See also