2

I have created a custom Authorize attribute to authorize users trough a remote web API. After authorization I receive a object with token that is valid for some specific time and is used to access further information and I also get some basic user data like name, surname, role, etc ... which I store in Session.

Everything worked just fine but when I tried using Output Caching the Session I'm accessing in my Authorization Core method is null and application crashes there.

How to solve this problem or perhaps an alternative approach avoiding this as last resort?

Authorize attribute

public class AuthorizeUser : AuthorizeAttribute
{
    private class Http401Result : ActionResult
    {
        public override void ExecuteResult(ControllerContext context)
        {
            // Set the response code to 401.
            context.HttpContext.Response.StatusCode = 401;
            context.HttpContext.Response.Write("Session expired, please log in again.");
            context.HttpContext.Response.End();
        }
    }


    private readonly string[] users;
    public AuthorizeUser(params string[] usrs)
    {
        this.users= usrs;
    }

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        bool auth = false;

        var loggedInUser= httpContext.Session["LoggedInUser"] as User;

        if (loggedInUser != null)
            auth = true;

        return auth;
    }

    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        if (filterContext.RequestContext.HttpContext.Request.IsAjaxRequest())
            filterContext.Result = new Http401Result();
        else
            filterContext.Result = new RedirectToRouteResult
            (
                new RouteValueDictionary
                    (
                        new
                        {
                            controller = "Account",
                            action = "Login",
                        }
                    )
            );
    }
}

Controller Setup

[AuthorizeUser]
public class SomeController : Controller
{
        [HttpPost]
        [OutputCache(VaryByParam ="Year", Duration = 3600)]
        public async Task<JsonResult> SomeAction(int Year){ ... }
}
Dino
  • 467
  • 1
  • 5
  • 14
  • See [this answer](https://stackoverflow.com/a/46565782/). – NightOwl888 Oct 12 '17 at 20:04
  • @NightOwl888 Reading the linked answer I might have grasped the idea of why but still am not able to come with a solution. All I can say is "sorry for being dumb" I guess. On the other hand after posting the question the other day I came with an alternative solution of using data application caching with dynamic keys and sliding expiration. – Dino Oct 13 '17 at 08:55

0 Answers0