Asp.Net WebApi上的自定义授权属性

Question

How do I return a value when a user is Authorized using ASP.Net Web Api? I tried overriding the OnAuthorize on the Authorize Attribute but the method type is 'void' so I can't return any value or should I append the values I want on the header as a response header?

Here's something I want to achieve :

1. User pass the api key and shared secret
2. When the user is authorize, the custom attribute will return the User's Id and Name
3. The Id will be used to be pass around Rest Methods as parameter

Answer 1

this code sample might help you.

public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
{
    base.OnAuthorization(actionContext);
    IManageUsers manageUser = new ManageUsers();
    //get authentication token from header + email
    string authenticationToken = string.Empty;
    string email = string.Empty;
    if (actionContext.Request.Headers.GetValues("email") != null && (!string.IsNullOrEmpty(Convert.ToString(actionContext.Request.Headers.GetValues("email").FirstOrDefault()))))
    {
        if (actionContext.Request.Headers.GetValues("authenticationToken") != null && (!string.IsNullOrEmpty(Convert.ToString(actionContext.Request.Headers.GetValues("authenticationToken").FirstOrDefault()))))
        {
            authenticationToken = Convert.ToString(actionContext.Request.Headers.GetValues("authenticationToken").FirstOrDefault());
            email = Convert.ToString(actionContext.Request.Headers.GetValues("email").FirstOrDefault());
            //check if user is activated 
            User user = manageUser.GetByEmail(email);
            if (user != null)
            {
                //if user is not authentication
                if (user.AuthenticationStatus != AuthenticationStatus.Authenticated)
                {
                    HttpContext.Current.Response.AddHeader("AuthenticationStatus", "NotAuthenticated");
                    actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Forbidden);
                    return;
                }

                //user is authentication, now check authorization
                string authenticationTokenPersistant = user.AuthorizationToken;
                //if length is not equal to the saved token
                var authenticationTokenEncrypted = manageUser.EncryptAuthenticationTokenAes(authenticationTokenPersistant, user.Key, user.IV);
                if (authenticationToken != authenticationTokenEncrypted)
                {
                    HttpContext.Current.Response.AddHeader("Email", email);
                    HttpContext.Current.Response.AddHeader("authenticationToken", authenticationToken);
                    HttpContext.Current.Response.AddHeader("AuthenticationStatus", "NotAuthorized");
                    actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Forbidden);
                    HttpContext.Current.Response.AddHeader("ErrorMessage", "Invalid token");
                    return;
                }

                HttpContext.Current.Response.AddHeader("Email", email);
                HttpContext.Current.Response.AddHeader("authenticationToken", authenticationToken);
                HttpContext.Current.Response.AddHeader("AuthenticationStatus", "Authorized");
                actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.OK);
            }
            else
            {
                actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.PreconditionFailed);
                HttpContext.Current.Response.AddHeader("ErrorMessage", "Email does not exist");
                return;
            }
        }
        else
        {
            actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.PreconditionFailed);
            HttpContext.Current.Response.AddHeader("ErrorMessage", "Please provide authentication token");
            return;
        }
    }
    else
    {
        actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.PreconditionFailed);
        HttpContext.Current.Response.AddHeader("ErrorMessage", "Please provide email address");
        return;
    }
}