如何在AuthorAttribute的ASP.NET Web.API MVC 5的IsAuthorized上获取Post参数

Question

I need to get values of my Post Parameters at the time of Authorization. Searchers on web but no solution is working. ActionArguments count always showing 0 and not able to find values in ActionDescriptor.GetParameters()

Here is my code:

POST model -

public class XyzModel
{
   public int Prop1 { get; set; }
   public string Prop2 { get; set; }
}

Custom Authorize Attribute -

public class CustomAuthorizeAttribute  : AuthorizeAttribute
{
   protected override bool IsAuthorized(HttpActionContext actionContext)
   {    
     bool conditions = // here I need to check value of my model (XyzModel) properties 
    if(conditions)
    {
       return true;
    }

      return false;
    }        
}

Code in controller -

[HttpPost]
[CustomAuthorizeAttribute]       
public IHttpActionResult MyAction(XyzModel model)
{
    // my work here
}

Any suggestion?

Answer 1

You can access model property of ActionArguments it will return XyzModel object. than you can perform any operation on its properties:

XyzModel model = (XyzModel)actionContext.ActionArguments["model"];

In your code it will be like this:

public class CustomAuthorizeAttribute  : AuthorizeAttribute
{
    protected override bool IsAuthorized(HttpActionContext actionContext)
    {
        var prop1 = HttpContext.Current.Request.Params["Prop1"];
        var prop2 = HttpContext.Current.Request.Params["Prop2"];
        bool conditions = // add conditions based on above properties
        if(conditions)
        {
            return true;
        }

        return false;
    }        
}

Answer 2

I believe, you will not get post parameter value in AuthorizeAttribute as AuthorizeAttribute methods are called before action's parameter binding.

For your scenario, you can use ActionFilterAttribute which executes only after action's parameter binding. You can create your custom filter attribute by using ActionFilterAttribute

using System.Web.Http.Controllers;
using System.Web.Http.Filters;

public class CheckMyPostDataFilter : ActionFilterAttribute
{
    public override void OnActionExecuting(HttpActionContext actionContext)
    {
        XyzModel model = (XyzModel )actionContext.ActionArguments["model"]; // you will get data here 

        base.OnActionExecuting(actionContext);
    }
}

You can simply decorate above CheckMyPostDataFilter filter in your action :

[HttpPost]
[CheckMyPostData]       
public IHttpActionResult MyAction(XyzModel model)
{
    // my work here
}

Answer 3

You can use Request Body Input Stream to read the entire Body content as below

public sealed class CustomAuthorizeAttribute : AuthorizeAttribute
{
    protected override bool IsAuthorized(HttpActionContext actionContext)
    {
        var req = HttpContext.Current.Request.InputStream;
        string body = new StreamReader(req).ReadToEnd();
    }
}