如何在ASP.NET Web API中处理持有者令牌的缺失或到期

Question

I have an ASP.NET web API and I want to return a meaningful message instead of this exception in case if the token was expired or it wasn't provided in the request at all. This is the exception that I'm getting in this case.

{
    "Message": "An error has occurred.",
    "ExceptionMessage": "An error occurred when trying to create a controller of type 'SomeController'. Make sure that the controller has a parameterless public constructor.",
    "ExceptionType": "System.InvalidOperationException",
    "StackTrace": "   at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.Create(HttpRequestMessage request, HttpControllerDescriptor controllerDescriptor, Type controllerType)\r\n   at System.Web.Http.Controllers.HttpControllerDescriptor.CreateController(HttpRequestMessage request)\r\n   at System.Web.Http.Dispatcher.HttpControllerDispatcher.<SendAsync>d__1.MoveNext()",
    "InnerException": {
        "Message": "An error has occurred.",
        "ExceptionMessage": "Object reference not set to an instance of an object.",
        "ExceptionType": "System.NullReferenceException",
        "StackTrace": "   at WebApi.Controllers.SomeController..ctor() in SomePath\\Controllers\\SomeController.cs:line 21\r\n   at lambda_method(Closure )\r\n   at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.Create(HttpRequestMessage request, HttpControllerDescriptor controllerDescriptor, Type controllerType)"
    }
}

I have tried like this and added a breakpoint, but it doesn't even reach it, so I'm not sure where should I write the code to handle this.

public override void OnAuthorization(HttpActionContext actionContext)
{
    JsonHelper jsonHelper = new JsonHelper();
    if (actionContext == null)
    {
        actionContext.Response = jsonHelper.setHttpResponseMessage(jsonHelper.setResponse(false, null, "Expired or Incorrect token."));
        return;
    }
}

Thanks in advance

Answer 1

Thanks to @Mark Wagoner comment, I saw this sentence in the exception which I didn't notice before

in SomePath\\Controllers\\SomeController.cs:line 21

In the controller in line 21, there is this line:

    ...    
    string variable = ClaimsPrincipal.Current.FindFirst("SomeValue").Value;

    public HttpResponseMessage Get()
    {
    ...

And since the token wasn't provided here, then it's to be expected that the above line would through Object reference not set to an instance of an object exception. I declared it outside the method because it is used in multiple methods. So, I removed it from there & declared it for each method and that solved my problem.

The thing that I didn't know is that the variables that I declare in the controller outside of the methods are declared first, then it starts executing the code in custom authorize CustomAuthorizeAttribute : AuthorizeAttribute class.