CODEWITHSUNDEEP
asp.net-mvc-4asp.net-web-api
uriDium
uriDium

Reputation: 13440

Cannot return HTTP Unauthorized from delegating Handler Web API

I am trying to implement authentication in a DelegatingHandler. Here is an example below.

public class AuthHandler: DelegatingHandler
{
    protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        var auth = request.Headers.Authorization;
        if (!auth.Scheme.Equals("UberSecureScheme"))
        {
            return new Task<HttpResponseMessage>(() => new HttpResponseMessage(HttpStatusCode.Unauthorized)
                {
                    Content = new StringContent("You have no token")
                });
        }

        return base.SendAsync(request, cancellationToken);
    } 
}

This never ever executes the task and no response is ever returned. If I change the code to do some task continuation thing like I have seen some examples then the Controller is executed first.

return base.SendAsync(request, cancellationToken)
           .ContinueWith(task =>
           {
               var response = task.Result;
               response.StatusCode = HttpStatusCode.Unauthorized;
               return response;
           });

This is obviously a disaster. I can't let someone do a delete and then tell them that they were unauthorized to do so.

I have also come across someone saying just throw an HTTPResponseException. No matter what status code I put in there (404, 401, whatever) the browser always gets a 500 internal server error.

Upvotes: 5

Views: 4901

Answers (2)

Sheddie
Sheddie

Reputation: 1

You can use Async/wait. I typed it, not copy/paste - don't ask, so hopefully no typing mistakes.... :)

protected async override Task<HttpResponseMessage>              SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
var response = await base.SendAsync(request, cancellationToken);
if (HttpContext.Current.User == null) {
    HttpResponseMessage errorResponse = new HttpResponseMessage();
    errorResponse.Headers.Add("WWW-Authenticate", "Some auth related message");
    errorResponse.StatusCode = HttpStatusCode.Unauthorized;
    return errorResponse;
}
return response;

Upvotes: 0

Vladimir
Vladimir

Reputation: 7475

if (!auth.Scheme.Equals("UberSecureScheme"))
{
    var response = request.CreateResponse(HttpStatusCode.Unauthorized);
    response.ReasonPhrase = "You have no token";
    return Task.FromResult<HttpResponseMessage>(response);
}

Upvotes: 9

Related Questions