CODEWITHSUNDEEP
c#restasp.net-web-api
puko
puko

Reputation: 2970

Roles in REST service

im developing REST service where have acces multiple users like standard user,insurance company or doctor etc.. All of this "users" have separate table in DB. After sign up of this users, token is generated and save in competent table. Now when one of this users send request e.g. doctor, /api/Doctor/Getpatients i check if token is valid and send response. My problem is when e.g insurance company send request to same url as doctor like /api/Doctor/Getpatients with valid token, i send response too, which is bad. I need some "Role management" which would ensure when e.g insurance comapny send request to doctors controller, response is unauthorized. Is any good practice how can i do that ?

Any help would be appreciated ..

Upvotes: 0

Views: 301

Answers (1)

Priyank Sheth
Priyank Sheth

Reputation: 2362

You should use Authorize attribute to prevent this. Where you can provide role of user. For your start you can refer below link which might give you all info you want:

Authentication & Authorizatio in aspnet web-api

Let me know if you stuck at somewhere.

Upvotes: 2

Related Questions