来自RestClient的Web Api请求

Question

I am using web api in xamarin forms. After login with microsoft account i am sending access token with request, every end point is working. But now we have implement the roles on controller based. I have used custom authentication. I want to get the userID from request, that is not coming with client request. My concern is, Should i get the user detail with token or any other way? please guide me. Steps that i am following to use the service:- 1. Login with Microsoft Account. 2. Get Access token and Pass in request header.

here is web api Custom AuthorizationFilter code:-

public override void OnAuthorization(HttpActionContext actionContext)
        {
            WMSEntities db = new WMSEntities();
            //IEnumerable<string> auth_token;
            //actionContext.Request.Headers.TryGetValues("x-zumo-auth", out auth_token);
            //var result = Get<List<AzureUserDetail>>(HttpWebRequest.Create(url + "/.auth/me"), auth_token.FirstOrDefault(), null)?.FirstOrDefault();


            //actionContext.Request.Headers.TryGetValues("email", out auth_token);
            string userID = actionContext.ControllerContext.RequestContext.Principal.Identity.Name;
            var user = db.UserProfiles.FirstOrDefault(x => x.Name == userID);

            if (user == null)
                actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Unauthorized);
            else
            {
                bool ok = false;
                foreach (var item in user.AppRoles)
                {
                    foreach (string ar in accessRoleNames)
                    {
                        if (item.Name == ar)
                            ok = true;
                    }
                }
                db.Dispose();

                if (!ok)
                    actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Unauthorized);
            }
            base.OnAuthorization(actionContext);
        }

Should i un-comment the three lines code or any other way to get the userID.

Answer 1

Since you are using token based auth, I would get user info based on the token.

You might run into the case where a user does not have a Identity on the server, but they have submitted a valid auth token.