将Authorization标头中的api密钥发送到REST Web API

Question

I have a REST Web API which receives some apiKey . An example of a GET action of this Web API is:

public HttpResponseMessage Get(int id, string apiKey)

The only route that is defined in my Web API is:

config.Routes.MapHttpRoute(
    name: "DefaultApi",
    routeTemplate: "{controller}/{id}",
    defaults: new { id = RouteParameter.Optional }
);

Now, there is a web client that uses this Web API and it sends the apiKey in the query string when doing GET requests.

I understand that it is better to send the apiKey in the Authorization header of the request.

Can someone show me how can I do a GET request and put that apiKey in the Authorization header and still land in the corect action method (I mean here the Get method above)?

Answer 1

You can trick web api into thinking the Authorization header is parameter that came from the query string with a small message handler.

 public class ApiKeyHandler : DelegatingHandler
    {
        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
        {
            var routeData = request.GetRouteData();

            if (request.Headers.Authorization != null && !routeData.Values.ContainsKey("apikey"))
            {
                routeData.Values.Add("apikey",request.Headers.Authorization.Parameter);
            }
            return base.SendAsync(request, cancellationToken);
        }
    }

This handler will grab the route data that has been extracted from the URI and if you pass an authorization header, it will take the parameter value and set it to be an apikey route parameter.

The authorization header needs to look something like

Authorization: apikey 12323434234234234

You can install the message handler by adding this link into your WebApiConfig.Register method.

config.MessageHandlers.Add(new ApiKeyHandler());

As an aside, you can use a handler like this to actually validate the ApiKey. This way you don't actually need to pass the apikey to your action method. Simply return a 401 directly from your handler if the ApiKey is no good.