AuthorizeAttribute is not working in .net 5 web api

Question

I am trying to implement custom authorization using System.Web.Http.AuthorizeAttribute, but It is not working. I have the following controller:

using System;
using System.Collections.Generic;
using System.Linq;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using WebApplication2.Helpers;

namespace WebApplication2.Controllers
{
    [ApiController]
    [Route("[controller]")]
    public class WeatherForecastController : Controller
    {
        private static readonly string[] Summaries = new[]
        {
            "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
        };

        private readonly ILogger<WeatherForecastController> _logger;

        public WeatherForecastController(ILogger<WeatherForecastController> logger)
        {
            _logger = logger;
        }

        [HttpGet]
        [CustomAuthorize]

        public IEnumerable<WeatherForecast> Get()
        {
            if (User.Identity.IsAuthenticated)
            {

            }
            var rng = new Random();
            return Enumerable.Range(1, 5).Select(index => new WeatherForecast
            {
                Date = DateTime.Now.AddDays(index),
                TemperatureC = rng.Next(-20, 55),
                Summary = Summaries[rng.Next(Summaries.Length)]
            })
            .ToArray();
        }
    }
}

And I created custom authorize attribute:

using System;
using System.Web.Http.Controllers;

namespace WebApplication2.Helpers
{
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
    public class CustomAuthorizeAttribute : System.Web.Http.AuthorizeAttribute
    {
        public override void OnAuthorization(HttpActionContext actionContext)
        {
            if (actionContext == null)
            {
                throw new Exception();
            }
        }

        protected override bool IsAuthorized(HttpActionContext actionContext)
        {
            bool isAuthroized = base.IsAuthorized(actionContext);

            return isAuthroized;
        }
    }
}

When calling Get weather forecast neither of OnAuthorization and IsAuthorized methods called. Can you please explain what is the problem here ?

Oleksandr · Accepted Answer · 2021-04-19 12:46:50Z

2

You are using AuthorizeAttribute from System.Web.Http namespace which is not used by ASP.NET Core. Implement IAuthorizationFilter interface instead

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class CustomAuthorizeAttribute : Attribute, IAuthorizationFilter
{
    public void OnAuthorization(AuthorizationFilterContext context)
    {
        //...
    }
}

answered Apr 19, 2021 at 12:46

Oleksandr

9,7601 gold badge22 silver badges45 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Tigran Petrosyan Over a year ago

IAuthorizationFilter is mvc library, I was trying to find a way for implementing authorization using only pure web api methods.IAuthorizationFilter interface is in System.Web.Mvc.

Oleksandr Over a year ago

@TigranPetrosyan There is no separate web api for ASP.NET Core. Everything is within MVC library

Collectives™ on Stack Overflow

AuthorizeAttribute is not working in .net 5 web api

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related