Note that there are some explanatory texts on larger screens.

plurals
  1. POWebAPI route message handler from other route gets called
    primarykey
    data
    text
    <p>I'm currently using WebAPI running on OWIN/Katana. I've defined two message handlers:</p> <ul> <li><code>CorsHandler</code>: Allowing CORS (Cross-origin resource sharing), will be applied on all HTTP messages</li> <li><code>HmacAuthenticationHandler</code>: Checks if the user is authenticated, will only be applied on routes which needs authentication.</li> </ul> <p>My <code>HttpConfiguration</code> will be configured like this:</p> <pre><code>var config = new HttpConfiguration(); /* configure routes for the web API */ // ### public routes ### config.Routes.MapHttpRoute("IndexRoute", "", new {controller = "Main", action = "get"}); config.Routes.MapHttpRoute("LoginRoute", "login", new {controller = "Account", action = "Login"}); config.Routes.MapHttpRoute("RegisterRoute", "register", new {controller = "Account", action = "Register"}); // ### routes that need authentication ### // according to http://www.asp.net/web-api/overview/working-with-http/http-message-handlers (last example) // List of delegating handlers. var handlers = new DelegatingHandler[] { new HmacAuthenticationHandler(controllerConfig.StorageHelper.UserLoginInfo) }; // Create a message handler chain with an end-point. var routeHandlers = HttpClientFactory.CreatePipeline(new HttpControllerDispatcher(config), handlers); // configure route config.Routes.MapHttpRoute("DefaultRoute", "{controller}/{id}", new {id = RouteParameter.Optional}, null, routeHandlers); /* other settings (JSON formatting, ...) */ /* dependency resolver, which will pass an instance of my DAO factory to each controller */ config.DependencyResolver = new ControllerDependencyResolver(daoFactory); /* apply CORS message handler to all messges */ config.MessageHandlers.Add(new CorsHandler()); </code></pre> <p>If I call an Web API method via AJAX call, which <strong>needs authentication</strong> (e.g. "127.0.0.1:80/test/id") everything work as expected. The message handler will be called as shown below:</p> <p><strong>Valid</strong> user credentials:</p> <p>Client -> CorsHandler -> HmacAuthenticationHandler -> TestController (get(id)) -> CorsHandler -> HmacAuthenticationHandler -> Client (OK-200)</p> <p><strong>Invalid</strong> user credentials:</p> <p>Client -> CorsHandler -> HmacAuthenticationHandler -> CorsHandler -> HmacAuthenticationHandler -> Client (Unauthorized request-403)</p> <hr> <p>But if I call an Web API method via AJAX call, which <strong>don't need authentication</strong> (e.g. "127.0.0.1:80/login"). The HmacAuthenticationHandler will be called "on the way back to the client", even though it is not assigned to this route:</p> <p>Client -> CorsHandler -> AccountController(login) -> CorsHandler -> <strong>HmacAuthenticationHandler</strong> -> Client (OK-200)</p> <p>Why will the <code>HmacAuthenticationHandler</code> be called on the "public route" (during the response)? Strange thing is it'll not influence the response, client still gets OK-200.</p> <hr> <p><strong>Update</strong></p> <p>I've created a sample project and replaced all internal interfaces/implementations with fake ones, the code can be found and downloaded on BitBucket:</p> <p><a href="https://bitbucket.org/Robar/stackoverflowquestionwebapi" rel="nofollow">https://bitbucket.org/Robar/stackoverflowquestionwebapi</a></p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload