WebApi自定义授权属性

Question

I've been grindign me head over this one. I've been trying to implement a custom authorize attribute for a WebApi. I've read multiple articles on how to do this, but for some reason the authorization is never executed.

public class ActivityAuthorizeWebApiAttribute : System.Web.Http.AuthorizeAttribute
{
    private string[] Activities { get; set; }
    public string Activity
    {
        set
        {
            this.Activities = value.Split(',').Select(x => x.Trim()).ToArray();
        }
        get { return string.Join(",", this.Activities); }
    }

    public ActivityAuthorizeWebApiAttribute()
    {
    }

    protected override bool IsAuthorized(HttpActionContext actionContext)
    {
        var principalUser = HttpContext.Current.User;
        if (principalUser == null || !principalUser.Identity.IsAuthenticated)
        {
            return false;
        }

        if (!principalUser.Activities().Any())
        {
            var activityProvider = (IActivityProvider)GlobalConfiguration.Configuration.DependencyResolver.GetService(typeof(IActivityProvider));
            var activities = activityProvider.GetActivitiesByRoleId(principalUser.Identity.GetUserId());
            principalUser.SetActivities(activities);

        }

        return principalUser.HasAnyActivity(this.Activities.ToList());

        //check your permissions
    }

}

As i can see i'm inheriting from the correct AuthorizeAtribute, not the mvc one. But the IsAuthorized method is never called. The controller action

[ActivityAuthorizeWebApi(Activity = "Home")]
public IEnumerable<string> Get()
{
    return new string[] { "value1", "value2" };
}

Could it be because of the combination with the bearer token Authentication?

Edit: I've even tried just this code:

public class CustomAuthorize : System.Web.Http.AuthorizeAttribute
{
}

As custom code, and not authorze is executed.

Answer 1

You need to be hooking into the following methods when you create a custom attribute :

 public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)

 protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)

 private bool AuthorizeRequest(System.Web.Http.Controllers.HttpActionContext actionContext)

Its the OnAuthorization Method that youneed to override and perform your security logic. You can get the User from the actionContext in the signature method.

public class CustomAuthorizeAttribute : AuthorizeAttribute

    {

         public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)

        {

            if (AuthorizeRequest(actionContext))

            {

                return;

            }

            HandleUnauthorizedRequest(actionContext);

        }

        protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)

        {

           //Code to handle unauthorized request

        }

        private bool AuthorizeRequest(System.Web.Http.Controllers.HttpActionContext actionContext)

        {

            //Write your code here to perform authorization

            return true;

        }

    }