1

I am exposing web API through ServicesApiController and want to authorize user through [AuthorizedUser(@"sitecore\ServicesAPI")] attribute of the function, everything is working fine, but instead of returning 401 status, Sitecore returning 404 status.

The solution I am thinking to terminate the request if authorization failed and return the request from the "OnAuthorization" method only or handle this scenario from 404 not found pipeline.

I am using this code for authorization

public override void OnAuthorization(HttpActionContext actionContext)
    {
        base.OnAuthorization(actionContext);
        var context = Context.User;
        //string test = context.ToString();
        if ((context.IsAuthenticated && context.Name.Equals(_user)))
            return;

        actionContext.Response =
            actionContext.ControllerContext.Request.CreateErrorResponse(HttpStatusCode.Unauthorized,
                "Unauthorized Access; User is " + Context.User.LocalName);
        base.OnAuthorization(actionContext);

    }

and validate the controller function like below:

[AuthorizedUser(@"sitecore\ServicesAPI")]

  • Is there an unauthorized exception you could throw? that's what I would do in a pure .net service. – Gravypower Mar 16 at 23:31
1

Try returning the response as :

actionContext.Response = new HttpResponseMessage((HttpStatusCode)401) { ReasonPhrase = "Unauthorized user" }
  • the problem is to return the status code, currently, it is going to Sitecore page and return 404, we need to terminate the request and send back to the API consumer client with 401 code – Ashish Bansal Mar 17 at 8:37
1

Try using AuthorizationContext.Result property.
So, here is full code of attribute:

using System.Net;
using System.Web.Mvc;
using Sitecore;

namespace [YOUR_NAMESPACE]
{
    public class AuthorizedUserAttribute : FilterAttribute, IAuthorizationFilter
    {
        private readonly string _user;

        public AuthorizedUserAttribute(string user)
        {
            _user = user;
        }

        public void OnAuthorization(AuthorizationContext filterContext)
        {
            var user = Context.User;
            if ((user.IsAuthenticated && user.Name.Equals(_user)))
                return;
            filterContext.Result = new HttpStatusCodeResult(HttpStatusCode.Unauthorized);
        }
    }
}

If you need also some JSON information in reponse as well, as with 401 error code, please see this stackoverflow question.

1

Please override HandleUnauthorizedRequest method to set unauthorized(401) response

public class CustomAuthorizeAttribute : AuthorizeAttribute  
{  
   public override void OnAuthorization(HttpActionContext actionContext)
   {
     // Here your core logic
   } 

   protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)  
   {  
      //set unauthorized(401) response
      filterContext.Result = new HttpUnauthorizedResult();  
   }  
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.