Web API AuthorizeAttribute does not return custom response

Question

How can I make IsAuthorized return my custom object while function returns false?

In my WebAPI project I have a class like;

public class CustomAuthorizeAttribute : AuthorizeAttribute
    {
        protected override bool IsAuthorized(System.Web.Http.Controllers.HttpActionContext actionContext)
        {

            StandardWebAPIResponse invalidUserResponse = new StandardWebAPIResponse()
                    {
                        code = (int) Constants.ErrorCodes.InvalidCredentials,
                        data = "InvalidCredentials.",
                        StatusCode = HttpStatusCode.Unauthorized
                    };
                    actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized,
                        invalidUserResponse);
                    // if I set this to true I am getting 401 with my custom object
                    // otherwise it gives me default error message 
                    // {"Message":"Authorization has been denied for this request."}
                    return false;
        }
    }

For some reason when I return false from IsAuthorized function, it does not return my custom invalidUserResponse object. But if I return true it returns it.

How can I resolve this issue?

You should override the OnAuthorization method, that use the IsAuthorized and flushs the response, or force a flush at your method. — Fals
– Fals, Commented Jun 17, 2015 at 15:59
How can I flush response, thus I could not find that function/option. — Teoman shipahi
– Teoman shipahi, Commented Jun 17, 2015 at 16:22
Yeah, I checked, they took .End() away from the Http namespace. You should override the OnAuthorization then, makes more sense fill the response there. — Fals
– Fals, Commented Jun 17, 2015 at 16:32
Thanks a lot, it works now. You can make your comments as a response then I can mark as an answer. It may help others too. — Teoman shipahi
– Teoman shipahi, Commented Jun 17, 2015 at 16:36

Tenderdude · Accepted Answer · 2016-06-22 15:08:52Z

5

I know this question has been answered but I feel like it is slightly wrong. I don't think that a message for unauthorized request should be handled by OnAuthorization but should be handled by HandleUnauthorizedRequest. I'm not sure if it will cause any major problems putting it in OnAuthorization, but presumably the reason you were getting the message when true and not false is because the base class writes over your response in HandleUnauthorizedRequest.

It is a subtle thing but the OnAuthorization directs to the HandleUnauthorizedRequest for a reason. It is mainly a separation of responsibilities thing, but if you ever want to do more than just sending an error message, like log bad request your OnAuthorization method will probably get crowded. You should used the methods given to you for clarity sake if nothing else.

answered Jun 22, 2016 at 15:08

Tenderdude

3213 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Leonardo Alves Machado · Accepted Answer · 2018-03-26 15:03:37Z

4

Yes I agree. You would need to implement custom filter derived from AuthorizeAttribute.

protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
{
    base.HandleUnauthorizedRequest(actionContext);
    actionContext.Response = new HttpResponseMessage
    {
        StatusCode = HttpStatusCode.Unauthorized,
        Content = new ObjectContent(typeof(ErrorMessage),
        new ErrorMessage()
        {
            StatusCode = (int)HttpStatusCode.Unauthorized,
            Message = Constants.UnauthorisedErrorMessage,
            ErrorCode = Constants.UnauthorisedErrorCode
        }, new JsonMediaTypeFormatter())
    };
}

edited Mar 26, 2018 at 15:03

Leonardo Alves Machado

2,84711 gold badges44 silver badges57 bronze badges

answered Mar 26, 2018 at 13:55

Sachin Hayatnagarkar

512 bronze badges

1 Comment

Teoman shipahi Over a year ago

Thanks, I will re-arrange my logic this way.

Fals · Accepted Answer · 2015-06-17 16:39:34Z

1

You should override the OnAuthorization method, that use the IsAuthorized and flushs the response, or force a flush at your method. Makes more sense fill the response where the filter manipulates It.

answered Jun 17, 2015 at 16:39

Fals

6,8394 gold badges26 silver badges46 bronze badges

Collectives™ on Stack Overflow

Web API AuthorizeAttribute does not return custom response

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related