Using AuthorizeAttribute in ASP.NET Web API

Question

I have used the [Authorize] attribute in an ASP.NET Web API method

[Authorize]
public IEnumerable<User> GetAllUsers()

From the application I can access this method without a problem as my user is already authenticated. However, is there any way that I can specify the username, password to this method when calling so that I can implement a REST API? This is when calling from a standalone application or the browser.

tugberk · Accepted Answer · 2012-07-16 10:57:02Z

2

I didn't entirely understand your question but System.Web.Http.AuthorizeAttribute checks against Thread.CurrentPrincipal to see if the user is authorized or not.

You can specifically give user permissions if you want as below:

[Authorize(Users = "User1")]
public IEnumerable<User> GetAllUsers()

But the Authentication process is entirely up to you. I would recommend authenticating the user through a message handler and then populating the Thread.CurrentPrincipal there. Then, use the AuthorizeAttribute as you see fit for your application.

answered Jul 16, 2012 at 10:57

tugberk

58.7k71 gold badges252 silver badges342 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Amila De Silva Over a year ago

I actually implemented a custom authorization based on the method header, So any 3rd party user can also be authenticated.

Collectives™ on Stack Overflow

Using AuthorizeAttribute in ASP.NET Web API

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related