Custom AuthorizeAttribute with custom authentication

Question

I am using ASP.NET MVC 4 Web application as a front-end for some WCF services. All the user log in/log out and session control is done on the back-end. MVC app should only

Answer 1

Regarding your first requirement:

As you already found out, OnAuthorization takes care of a number of aspects, including e.g. caching.
If you are only interested in customizing the way in which user credentials are validated, I suggest you go for overriding AuthorizeCore instead. E.g.:

public class ClientCookieAuthorizeAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        HttpCookie cookie = httpContext.Request.Cookies[_tokenCookieName];

        bool isAuthenticated = ValidateUserByCookie(cookie);

        return isAuthenticated;
    }

    private bool ValidateUserByCookie(HttpCookie cookie)
    {
        var result = false;
        // Perform validation
        // You could include httpContext as well, to check further information
        return result;
    }

    private static const string _tokenCookieName = "myCookieName";
}

You might also want to give a look at this other threads:

1. SO - Custom Authorize Attribute
2. ASP.NET - Custom AuthorizationFilter redirect problems
3. Diary of a ninja