Web API
Action Filter is used to add extra logic before or after action method execute,
it could be used for authentication, authorization and logging.
Web API
Action filter is used as attribute which can be used for action method, Web API
controller or for whole application.
For more information about The
Lifecycle of an ASP.NET Web API
ASP.NET
Framework provides the ActionFilterAttribute abstract class to implement own
custom action filter.
ActionFilterAttribute abstract class has the following
methods, which you can override
- OnActionExecuting – This method is called before a
controller action is executed.
- OnActionExecuted – This method is called after a
controller action is executed.
Both methods
have HTTPActionContext
object reference and with help of httpActionContext object we can easily get
the current HTTP request object and be able to read http request information
like header, request URL, data and requested user information.
Here is an
example to create a custom action filter to allow only specific role to access
action method.
public class RestrictedAction : ActionFilterAttribute
{
public override void OnActionExecuting(HttpActionContext actionContext)
{
var isAuthorized = false;
IEnumerable<string>
values;
var areHeadersPresent = actionContext.Request.Headers.TryGetValues("X_API_Token", out values);
ClientData client;
if (areHeadersPresent)
{
client = ClientHelper.GetClient(values.FirstOrDefault());
if(client.Role == "Admin")
{
isAuthorized = true;
}
}
if (!isAuthorized)
{
actionContext.Response =
actionContext.Request.CreateResponse(HttpStatusCode.Forbidden, "Unauthorized Access");
}
base.OnActionExecuting(actionContext);
}
}
In Action
Filter, we are reading API Token from HTTP request’s header and if specific
header presents, then it calls the GetClient method of ClientHelper class to
get client information based on passed token.
If the role
of current client is not admin, we will reject request and throw Forbidden HTTP
Response
Action Filter used for specific Action
Method:
If we want to
put restriction on specific method, simply apply RestrictedAction attribute to method.
Only Admin
Role use can able to Call the SaveOrder action to create a new order, for other
roles, API will rejects request.
public class OrderController : ApiController
{
IOrderEngine _orderEngine;
public OrderController(IOrderEngine orderEngine)
{
_orderEngine = orderEngine; }
[HttpGet]
[Route("api/Order")]
[ResponseType(typeof(Order))]
public IHttpActionResult GetOrder(int orderNumber)
{
Order order =
_orderEngine.GetOrderByNumber(orderNumber);
if(order == null)
{
return NotFound();
}
return Ok(order);
}
[HttpPost]
[Route("api/Order")]
[ResponseType(typeof(Order))]
[RestrictedAction]
public IHttpActionResult SaveOrder(Order order)
{
Order order = _orderEngine.SaveOrder(order);
if (order == null)
{
return BadRequest("Not able to Create an
Order");
}
return Ok(order);
}
}
Action Filter used for all methods of
Web API Controller:
If we want to
put restriction on specific web API controller, simply apply attribute to web
api controller class
Only Admin
Role use can able to call any action method of this OrderController API, for
other roles, API will rejects request.
[RestrictedAction]
public class OrderController : ApiController
{
IOrderEngine _orderEngine;
public OrderController(IOrderEngine orderEngine)
{
_orderEngine = orderEngine; }
[HttpGet]
[Route("api/Order")]
[ResponseType(typeof(Order))]
public IHttpActionResult GetOrder(int orderNumber)
{
Order order =
_orderEngine.GetOrderByNumber(orderNumber);
if(order == null)
{
return NotFound();
}
return Ok(order);
}
}
Action Filter used for all Web API
Controllers:
If we want to
put restriction on all web API controllers in your application, simply add
below setting in web api config file
Only Admin
Role use can able to call any API’s method of this web api application, for
other roles, API will rejects request.
public static class WebApiConfig
{
public static void Register(HttpConfiguration config)
{
// Web API
configuration and services
config.Filters.Add(new RestrictedAction());
// Web API
routes
config.MapHttpAttributeRoutes();
config.Routes.MapHttpRoute(
name: "DefaultApi",
routeTemplate: "api/{controller}/{id}",
defaults: new { id = RouteParameter.Optional }
);
}
}
No comments:
Post a Comment