How to Customize ASP.NET Web API AuthorizeAttribute for Unusual Requirements

by

The best solution for my scenario appears to be bypass the base OnAuthorization completely. Since I have to authenticate each time cookies and caching the principle are not of much use. So here is the solution I came up with:

public override void OnAuthorization(HttpActionContext actionContext)
{
    string username;
    string password;

    if (GetUserNameAndPassword(actionContext, out username, out password))
    {
        if (Membership.ValidateUser(username, password))
        {
            if (!isUserAuthorized(username))
                actionContext.Response = 
                    new HttpResponseMessage(System.Net.HttpStatusCode.Forbidden);
        }
        else
        {
            actionContext.Response = 
                new HttpResponseMessage(System.Net.HttpStatusCode.Unauthorized);
        }
    }
    else
    {
        actionContext.Response = 
            new HttpResponseMessage(System.Net.HttpStatusCode.BadRequest);
    }
}

I developed my own method for validating the roles called isUserAuthorized and I am not using the base OnAuthorization any more since it checks the current Principle to see if it isAuthenticated. IsAuthenticated only allows gets so I am not sure how else to set it, and I do not seem to need the current Principle. Tested this out and it works fine.

Still interested if anyone has a better solution or can see any issues with this this one.

More Related Contents:

  1. Returning binary file from controller in ASP.NET Web API
  2. Asp.NET Web API – 405 – HTTP verb used to access this page is not allowed – how to set handler mappings
  3. WebAPI to Return XML
  4. How to return raw string with ApiController?
  5. ASP.net MVC4 WebApi route with file-name in it
  6. Web API Queryable – how to apply AutoMapper?
  7. ‘System.Net.Http.HttpContent’ does not contain a definition for ‘ReadAsAsync’ and no extension method
  8. All requests to ASP.NET Web API return 404 error
  9. What is the difference between ‘classic’ and ‘integrated’ pipeline mode in IIS7?
  10. Best way to trim strings after data entry. Should I create a custom model binder?
  11. How to support HTTP OPTIONS verb in ASP.NET MVC/WebAPI application
  12. Return XML from a controller’s action in as an ActionResult?
  13. What is the equivalent of Server.MapPath in ASP.NET Core?
  14. ASP.NET 4.5 MVC 4 not working on Windows Server 2008 IIS 7
  15. 404 error after adding Web API to an existing MVC Web Application
  16. Infinite URL Parameters for ASP.NET MVC Route
  17. How to remove returnurl from url?
  18. Redirect to a page with endResponse to true VS CompleteRequest and security thread
  19. New Asp.Net MVC5 project produces an infinite loop to login page
  20. JQuery’s $ is in conflict with that of StringTemplate.Net in ASP.Net MVC
  21. Linq Orderby random ThreadSafe for use in ASP.NET
  22. Adding sub-directory to “View/Shared” folder in ASP.Net MVC and calling the view
  23. Difference Between ViewResult() and ActionResult()
  24. How to add Web API to an existing ASP.NET MVC (5) Web Application project?
  25. Streaming large file uploads to ASP.NET MVC
  26. Change User Id type to int in ASP.NET Identity in VS2015
  27. Value cannot be null. Parameter name: items (DrodownList)
  28. What do the TargetFramework settings mean in web.config in ASP .NET MVC?
  29. WCF Service or Web API [closed]
  30. How does Html.Raw MVC helper work?

Leave a Comment