I've MVC WebAPI exposed and would like to only accept a request from 127.0.0.1. The reason being that the application that is going to consume this WebAPI function will be hosted on same IIS server as virutal application.
Could someone please suggest how above can be achieved and whether there's much elegant solution.
Override DelegatingHandler and write a custom handler,which will check for host of request,if that matches your criteria then go ahead or reject the request.
public class CustomHandler : DelegatingHandler
{
protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
//check here for host of request
if(!criteria)
{
request.Properties.Add("Forbidden", true);
}
return base.SendAsync(request, cancellationToken);
}
}
Register this handler in WebApiConfig as
public static void Register(HttpConfiguration config)
{
config.MessageHandlers.Add(new CustomHandler());
}
Do you need to do these by custom software?
You might set up iis to bind to only the internal address (maybe even change the port) and make sure the firewall of server does not expose that binding.
Can you clearify on the reason for wanting this? If you only bind the localhost and do not expose your WebApi may you could call the api methods directly from your code.
