I want to create a Web API MVC. This API will authorize TOKEN JWT, and I want to create my own Authorize attribute like CanRead, CanModify, CanWrite. Three attributes just inherit Attribute class (no AuthorizeAttribute), is it ok ?
My application have complicates role and permission so I want to customize all about authorization and authentication. I want to manage the permission dynamic
So how can I do it ?
Will I access database from attributes (CanRead or CanModify) to check permission
Create a custom AuthorizeAttribute instead. an example below.
public class KeyAuthorizeAttribute : AuthorizeAttribute
{
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
string key = httpContext.Request["X-Key"];
return ApiValidatorService.IsValid(key);
}
}
public static class ApiValidatorService
{
public static bool IsValid(string key)
{
int keyvalue;
if (int.TryParse(key, out keyvalue))
{
return keyvalue % 2137 == 7;
}
return false;
}
}
Taken from Jon Galloway's blog. I don't know specifically how you are authorizing, but if you create a class with:
public bool CanRead { get; set; }
public bool CanWrite { get; set; }
public bool CanModify { get; set; }
And then within the AuthorizeCore method, determine based on the setting if the user has the right permission.
