Accessing QueryString in a custom AuthorizeAttribute

Question

I am using Web API and have setup a simple authentication and authorization mechanism where the caller passes a token that I have issued to them in the query string. So they submit a request like:

https://mysite.com/api/Ping?token=[issued-token]

I have an ApiAuthorizeAttribute like this:

public class ApiAuthorizeAttribute : System.Web.Http.AuthorizeAttribute
{
    public ApiPermission Permission { get; set; }

    public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        switch (Permission)
        {
            case ApiPermission.None: 
               return;

           case ApiPermission.Write:
           case ApiPermission.Read:

               string query = actionContext.Request.RequestUri.Query;
               var nvc = System.Web.HttpUtility.ParseQueryString(query);
               string token = nvc["token"];

               // (my code to map the token to an Authorization for the request)               
               ApiAuthorization auth = ApiToken.GetAuthorization(token);
               if (auth != null && auth.HasPermission(Permission))
                   return;

               HandleUnauthorizedRequest(actionContext);
               return;

           default:
               throw new ArgumentException("Unexpected Permission");
        }
    }
}

Then I can decorate my APIs like this. Note: this is just an example, a real call would read data from their account (an account identifier is encrypted within their token) and return it.

/// <summary>
/// Ping service that requires a Token with Read permission
/// Returns "Success!"
/// </summary>
[ApiAuthorize(Permission = ApiPermission.Read)]
[HttpGet]
public string Ping()
{
    return "Success!";
}

As you might note, I could not access the QueryString anywhere from HttpActionContext parameter and had to build it myself. It seems like they explicitly removed QueryString from this Request object. I don’t want to add “token” it to each and every API method in order to get it in the Route Data.

So my questions are:

Is the QueryString in there somewhere and I am just missing it? If not, any idea why Microsoft doesn't include it with this Request object? (i.e. maybe this is a bad thing to do?)
Is there a better way to deal with getting the token in the AuthorizeAttribute (again, without adding it to each call)?

BTW, I realize there are other (probably better) options for authorization such as Basic Authentication and OAuth, and I do not want to debate that topic here.

Have you tried actionContext.Request.QueryString. stackoverflow.com/questions/2219647/… — Satpal
– Satpal, Commented May 29, 2013 at 5:29
@Satpal, yes I had assumed that property would be there when I started writing my code. But that particular Request object does not have that property. That is the crux of my question - why not? — ThisGuy
– ThisGuy, Commented May 29, 2013 at 5:32
actionContext.Request.RequestUri.Query may also be useful. http://stackoverflow.com/questions/12817202/accessing-post-or-get... — Kristopher
– Kristopher, Commented May 14, 2014 at 2:43

Buvy · Accepted Answer · 2019-04-24 20:07:04Z

38

While Adam Tal's answer is perfectly valid, in the Web API new world order you really do not want to use anything from the System.Web namespace; in fact you don't even want to reference it. Alas you can get to the querystring from the GetQueryNameValuePairs() extension method. That will let you cut System.Web boat anchor loose and still get to what you need.

using System.Net.Http;

var queryString = actionContext.Request
        .GetQueryNameValuePairs()
        .ToDictionary(x => x.Key, x => x.Value);

edited Apr 24, 2019 at 20:07

answered Sep 11, 2014 at 21:10

Buvy

1,38414 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Matt Burland Over a year ago

Just to add (because it took me a second to find it), you can find this extension method by using the System.Net.Http namespace.

Adam Tal Over a year ago

Completely right. Especially if someone wants to work with vnext and get rid of System.Web. You've got my upvote :)

Adam Tal · Accepted Answer · 2013-05-29 05:16:31Z

12

Try

using System.Web;

HttpContext.Current.Request.QueryString

answered May 29, 2013 at 5:16

Adam Tal

5,9714 gold badges32 silver badges49 bronze badges

7 Comments

ThisGuy Over a year ago

Yes, that works. It was a rather long-winded question for such a such a straightforward answer... But I am still left wondering why it is not in their Request object - it is leaving me with the feeling that maybe I shouldn't be grabbing parameters off the query string in the AuthorizeAttribute.

PUG Over a year ago

any ideas how to access post request

Adam Tal Over a year ago

@jaminator - Try using HttpContext.Current.Request.Form dictionary which contains the post data instead of the QueryString which takes the data from the url.

PUG Over a year ago

@AdamTal data is passed to me in json post request

Adam Tal Over a year ago

@jaminator - did you try what I've suggested?

|

aranjan · Accepted Answer · 2019-09-25 10:39:15Z

1

NameValueCollection queryString = actionContext.Request.RequestUri.ParseQueryString();

It works for me.

answered Sep 25, 2019 at 10:39

aranjan

487 bronze badges

Collectives™ on Stack Overflow

Accessing QueryString in a custom AuthorizeAttribute

3 Answers 3

2 Comments

7 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

7 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related