asp.net - WebApi's OnAuthorizarion - Clarification? -
asp.net - WebApi's OnAuthorizarion - Clarification? -
looking @ custom authorizeattribute , know right method checking authorization isauthorized method :
for illustration :
protected override bool isauthorized(httpactioncontext actioncontext) { bool isauthroized = base.isauthorized(actioncontext); homecoming isauthroized && my_other_conditions; //! } like said know that.
but let's i've decided override onauthorization :
here example code existing library:
public class customerordersauthorizeattribute : authorizeattribute { public override void onauthorization(httpactioncontext actioncontext) { base.onauthorization(actioncontext); // if not authorized @ all, don't bother checking // client - order relation if (actioncontext.response == null) { //get client key int customerkey = getcustomerkey(actioncontext.request.getroutedata()); //check customer-order relation if (!customer.name.equals(thread.currentprincipal.identity.name)) { actioncontext.response = request.createresponse(httpstatuscode.unauthorized); } } } } question:
looking @ author's code : if (actioncontext.response == null) {...} , comment : "if not authorized @ all"
— right way checking if exception has not occurred in onauthorization method ? checking response == null ? (which means : no exception output base.onauthorization) ?
(seems unusual me , because exception can occur , still response null.....or wrong ? - lastly thing want start investigate headers codes errors...)
nb
my question targeting webapi1 not 2.x
answer here :
read badri's lastly comment in answer
custom authorization in asp.net webapi - mess?
also here http://i.stack.imgur.com/dnlyl.jpg
asp.net asp.net-web-api web-api
Comments
Post a Comment