Web API Authentication with HttpModule

Question

I'm building a WebApi application which needs to authenticate for every request by validating credentials from the HTTP header sent.

I was hoping to use an HttpModule for this, but when I debug, the module is only hit when I start the app. I can actively fire requests at a controller action and it will never hit the HttpModule (and thus never check credentials).

I've activated the HttpModule in the web.config like so:

<system.webServer>
    <modules>
      <add name="BasicAuthHttpModule" type="MyAssembly.Modules.BasicAuthHttpModule"/>
    </modules>

Why does the module not run when I call the controller - is this method not appropriate for authenticated WebApi apps? I can't use IIS authentication in my case.

Kevin · Accepted Answer · 2015-08-26 20:03:49Z

1

If your goal is to ensure every single incoming Http request has the appropriate BasicAuth headers, try adding the runAllManagedModulesForAllRequests attribute to the module in your config file:

<modules runAllManagedModulesForAllRequests="true">
  <add name="BasicAuthHttpModule" type="MyAssembly.Modules.BasicAuthHttpModule"/>
</modules>

A more appropriate solution would be to use an Action Filter for authorization:

http://www.ryadel.com/en/http-basic-authentication-asp-net-mvc-using-custom-actionfilter/

answered Aug 26, 2015 at 20:03

Kevin

1,8791 gold badge23 silver badges22 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Web API Authentication with HttpModule

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related