I've created a custom API Controller that inherits from ServicesApiController. I've created also custom route and it all works fine.
Something like the following:
public class ExampleController : ServicesApiController
{
public ActionResult Index()
{
return null;
}
}
However I want to ensure that this is secured and doesn't expose my list of items to unauthorized users.
I was thinking of applying the same requirements as the ItemService and requiring use of the auth/login endpoint before requests can be made to my custom controller.
However after digging into the code for the ItemService with DotPeek I can't seem to find how this is implemented for the ItemService.
I thought it would be using a custom filter that checks whether user is authenticated.
I've read over the docs here:
And it says:
Sitecore.Services.Client provides two layers of security:
- A security policy that applies to all Sitecore.Services.Client requests.
- Individual filters that can add additional requirements on requests that are to be executed.
So this also suggests that.
I'd appreciate any guidance on if there is a filter I can use to require login or if I need to create my own that does something like:
public override void OnAuthorization(HttpActionContext actionContext)
{
if (Context.User.IsAuthenticated){
return;
}
actionContext.Response = actionContext.ControllerContext.Request.CreateErrorResponse(HttpStatusCode.Unauthorized, "Unauthorized Access");
base.OnAuthorization(actionContext);
}
Or is there a better way to do this?
Other Info: Sitecore 8.2. Update 6