Web Api Interceptor

Question

I have created a custom authorize attribute on my web api. My goal is to check if the user has permission to access the web api url directly else redirect him to an unauthorized page.This process requires me to add [CustomAuthorize("modulename")] everywhere.Is there any other way I can do this? Probably by interceptors?.Any guidance would be greatly appreciated.

         Customised authorize attribute pseudo code snippet: 

        public override void OnAuthorization(HttpActionContext context){
                var username = HttpContext.Current.Request.LogonUserIdentity.Name;
                 var  accesiblemodulelistforuser = GetPermissions(username );

                if (user != null)
            {
                if (modulename does not exist in list )
                {
                var response = 
                context.Request.CreateResponse(HttpStatusCode.Forbidden);
                    context.Response = response;

                }
           else{
          return;

                }

                  }
              else{
                        //redirect to unauthorized page
                  }
              }

Ivvan · Accepted Answer · 2018-11-16 08:40:03Z

There is no class definition in your's neither ASP.NET version, so I assume that you inherit the ActionFilterAttribute class . Just noticed, that you're not. See edited version. If so, than you can register your filter globally for all web api actions and controllers in WebApiConfig.cs like this:

public static void Register(HttpConfiguration config)
{
    config.Filters.Add(new CustomAuthorize());
}

Edit

Totally misunderstood your's situation. So there is more info. You can use your own global authorization filters:

public class CustomAuthorize : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            // user not authorized, redirect to login page
            filterContext.Result = new HttpUnauthorizedResult();

            return;
        }

        string roleName = GetModuleName(filterContext);
        var user = filterContext.HttpContext.User;


        // Chaeck user permissions
        if (!user.IsInRole(roleName))
        {
            // Handle not authorized requests and redirect to error page
            filterContext.Result = new RedirectResult("~/Error/NotAuthorized");
            return;
        }

        base.OnAuthorization(filterContext);
    }

    string GetModuleName(AuthorizationContext filterContext)
    {
        var controllerName = filterContext.ActionDescriptor.ControllerDescriptor.ControllerType.FullName;
        var actionName = filterContext.ActionDescriptor.ActionName;

        return controllerName; // or actionName
    }
}

Than you can register your filter globally for all actions and controllers in WebApiConfig.cs like this:

public static void Register(HttpConfiguration config)
{
    filters.Add(new CustomAuthorize());
}

or use only on specific controllers/actions.

Just be careful, this approach doesnt work for web api, only mvc, as web api has it's own AuthorizeAttribute located in System.Web.Http (MVC version is located in System.Web.Mvc). Implementation is slightly different, but you can just looks for examples. So you will need to have who different attributes - one for MVC and one for WEB API. See original answer to know how to register WEB API filter globally, or use it only for specific controllers.

Collectives™ on Stack Overflow

Web Api Interceptor

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related