1

I registered a MessageHandler (with config.MessageHandlers.Add(new ValidationHandler()) which inherits from DelegatingHandler. It checks each Request for a security token and checks if it is valid.

I got 2 or 3 actionmethods in my Controller which should be accessabel without any authorization.

My Problem: The MessageHandler is called first. So the actionmethod which should be accessabel from everywhere will be handled as a unauthorized request. I'm not abel to change the code of the MessageHandler. I tried to add the allowanonymous attribute, but i still get an unauthorized response.

I found this post Redirecting unauthorized controller in ASP.NET MVC . So my current idea would be to forward the user on the HandleUnauthorizedRequest to the proper action method. But I think it's not the best way.

Is there a better way for this? Is there a way to tell the web.config that actionmethod1 and actionmethod2 are allowed to be accessed as Unauthorizeded user?

[Edit] Creating an UnAuthorizeAttribute with the AuthorizeAttribute which forwards the user still to the action methods doesn't work. The messagehandler "kills" the request with

            statusCode = HttpStatusCode.Unauthorized;
            return Task<HttpResponseMessage>.Factory.StartNew(() => new HttpResponseMessage(statusCode));

So the UnAuthorizeAttribute will not be invoked. I'm using asp.net mvc webapi

Community
  • 1
  • 1
Briefkasten
  • 1,964
  • 2
  • 25
  • 53
  • [AllowAnonymous] attribute is not suitable? – aleha_84 Sep 12 '14 at 21:03
  • AllowAnonymous will not work, because the actionmethod with the AllowAnonymous attribute will not be called when Task.Factory.StartNew(() => new HttpResponseMessage(HttpStatusCode.Unauthorized)); is set – Briefkasten Sep 15 '14 at 10:47

1 Answers1

0

You can try creating actionfilter to handle this as you know the request you are getting into the controller / action. This is just and idea.

http://www.codeproject.com/Articles/650240/A-Simple-Action-Filter-Overview

Hope this helps.

DSR
  • 4,588
  • 29
  • 28
  • I'm using a BaseController (WebAPI) and overrided the method ExecuteAsync(System.Web.Http.Controllers.HttpControllerContext controllerContext, CancellationToken cancellationToken) and added an breakpoint. But it will not be hit if an unauthorized request was made. – Briefkasten Sep 12 '14 at 14:25