25

I'm having trouble figuring out how to implement an authorization filter in Web API using IAuthorizationFilter from System.Web.Http.Filters.

This is a simple filter I wrote to respond to all non-https requests with a 403 forbidden response:

public class HttpsFilter : IAuthorizationFilter {
    public bool AllowMultiple {
        get {
            return false;
        }
    }

    public Task<HttpResponseMessage> ExecuteAuthorizationFilterAsync( HttpActionContext actionContext, CancellationToken cancellationToken, Func<Task<HttpResponseMessage>> continuation ) {
        var request = actionContext.Request;

        if ( request.RequestUri.Scheme != Uri.UriSchemeHttps ) {
            HttpResponseMessage response = request.CreateResponse( HttpStatusCode.Forbidden );
            response.Content = new StringContent( "<h1>HTTPS Required</h1>", Encoding.UTF8, "text/html" );
            actionContext.Response = response;

            return new Task<HttpResponseMessage>( delegate() {
                return response;
            } );
        }
        else
            return continuation();
    }
}

What I have written so far runs, but when I try to access the api over regular http, it just hangs and I never get a response.

1

2 Answers 2

10

For you scenario, you could simply derive from the "System.Web.Http.AuthorizeAttribute".

Example:

public class HttpsFilterAttribute : System.Web.Http.AuthorizeAttribute
{
    public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        //do something
    }
}
3
  • 1
    I actually did this originally and will probably end up sticking with it (because it's simpler and easier to understand). I was just trying to implement the bare interface to gain some understanding about what was going on underneath the hood of that class. Apr 12, 2013 at 19:26
  • 2
    Kiran is right. Derive from AuthorizeAttribute - there is more going on than just the custom authZ logic (e.g. support for AllowAnonymous). If you want to know how it works internally, use reflector. Apr 13, 2013 at 13:36
  • 8
    There are reasons why you would want to use the interface instead of AuthorizeAttribute. AuthorizeAttribute is nice because it handles a lot of stuff for you and exposes some convenience methods that make the process easier, but it also couples Attribute with Filter. This makes it impossible to inject dependencies into the filter constructor. Further, your filter can't use generics. All of this is solved by splitting the concerns of the filter and attribute. Of course, this all assumes your filter is meant to complement or is completely unrelated rather than supplement AuthorizeAttribute.
    – crush
    Jan 27, 2016 at 18:26
6

You either need to save the task into a variable and call the task.Start() method before returning it, or use the Task<HttpResponseMessage>.Factory.StartNew(Action action) method to create the task.

1
  • 18
    In this (quasi-asynchronous) case, how about return Task.FromResult<HttpResponseMessage>(response); Jan 27, 2014 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.