3

I am using a 3rd party library names telogis map in my project. For one of its functionality called Clustering, it is not possible to send request header. Only query string can be passed for clustering and entire logic of API call is done within the JS library.

My project use Bearer token based authenticate and built with Web API 2. To resolve this issue I have passed access token in query string and want validate the request. I created below CustomAuthorize attribute for this:

public class ClusterRequestAuthorizeAttribute : AuthorizeAttribute
    {
        public override void OnAuthorization(HttpActionContext actionContext)
        {
            base.OnAuthorization(actionContext);
        }

        public override Task OnAuthorizationAsync(HttpActionContext actionContext, CancellationToken cancellationToken)
        {
            string accessToken = actionContext.Request.GetQueryNameValuePairs().Where(w => w.Key == "access_token").Select(w => w.Value).DefaultIfEmpty().FirstOrDefault();
            actionContext.Request.Headers.Remove("Authorization");
            actionContext.Request.Headers.Add("Authorization", accessToken);

            actionContext.ControllerContext.Request.Headers.Remove("Authorization");
            actionContext.ControllerContext.Request.Headers.Add("Authorization", accessToken);

            HttpContext.Current.Request.Headers.Remove("Authorization");
            HttpContext.Current.Request.Headers.Add("Authorization", accessToken);

            return base.OnAuthorizationAsync(actionContext, cancellationToken);
        }

        protected override bool IsAuthorized(HttpActionContext actionContext)
        {
            return base.IsAuthorized(actionContext);
        }
    }

But IsAuthorized is always returning false. I reviewed the Authorize API internal function using Git Link

According to it, I have to set actionContext.ControllerContext.RequestContext.Header which is not accessible due to protection level as it is marked as internal.

Is there any other work around for this issue or can it be done in better way?

Manprit Singh Sahota
  • 1,279
  • 2
  • 14
  • 37
  • Why don't you remove [Authorize] for that functionality? This way you will enter the method and there you can check the query string if access shuold be granted or denied. –  May 17 '17 at 06:16
  • @RuardvanElburg: This is what I want to achieve. But how can I get user details from access token i.e. UserId. I want to query data through user id. Can you provide detail regarding this? – Manprit Singh Sahota May 17 '17 at 06:57
  • I think you can find your answer here: http://stackoverflow.com/questions/20585872/get-iprincipal-from-oauth-bearer-token-in-owin –  May 17 '17 at 07:50

0 Answers0