title: Web API Resource Authorizations
body: <p>I'm currently building a Web API but have run into an authorization problem with GET requests.  Essentially my problem is how do I authorize requests based on the request parameters.  I've tried looking online but the only solution I can find for resource authorization is to create my own authorization filter attribute.  So lets say a client belongs to a Fac 8474, so they should be able to get <code>api/fac/8474</code>.  But what is stopping the user from getting <code>api/fac/8475</code>?  The code below uses a custom auth filter that gets the users claim value for nId.  After getting the requested record I check the nId value on the record.  If they are equal I allow access, if not I send a 401 unauthorized.  However, I will have to write this code for every route and that I don't like the thought of writing extra code for each request which might include even more logic then a simple int check.</p>
  
  <pre><code>class ClaimsAuthorizationFilter : AuthorizationFilterAttribute
          {
              public override Task OnAuthorizationAsync(HttpActionContext actionContext, System.Threading.CancellationToken cancellationToken)
              {
                  var principal = actionContext.RequestContext.Principal as ClaimsPrincipal;
  
                  KeyValuePair&lt;string, object&gt; facId = actionContext.RequestContext.RouteData.Values.Where(p =&gt; p.Key == "facId").SingleOrDefault();
                  Claim nIdClaim = principal.Claims.Where(p =&gt; p.Type == "nId").SingleOrDefault();
  
                  if (nIdClaim == null) {
                      actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
                      return Task.FromResult&lt;object&gt;(null);
                  }
  
                  SM msg = ClientAPI.GenerateResponse("FAC_GET", Convert.ToInt32(facId.Value));
                  dtoFac fac = (dtoFac)msg.Data;
  
                  if (nIdClaim.Value != fac.nId.ToString())
                  {
                      actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
                      return Task.FromResult&lt;object&gt;(null);
                  }
                  return Task.FromResult&lt;object&gt;(null);
              }
          }
  </code></pre>
  
  <p>I've also looked at this example <a href="http://jakeydocs.readthedocs.io/en/latest/security/authorization/resourcebased.html" rel="nofollow noreferrer">http://jakeydocs.readthedocs.io/en/latest/security/authorization/resourcebased.html</a> Essentially getting the resource then checking the nId which I also implemented and it works.</p>
  
  <pre><code>var identity = User.Identity as ClaimsIdentity;
  Claim nId = identity.Claims.Where(p =&gt; p.Type == "nId").SingleOrDefault();
  
  if (nId == null) {
       return NotFound();
  }
  
  // Get list of resources named bat
  
  if (!IEnumAuthCheck(bat, nId.Value)) {
       return NotFound();
  }
  
  private bool IEnumAuthCheck(IEnumerable&lt;bat&gt; list, string nId)
      {
          foreach (bat element in list)
          {
              if (element.nId != Convert.ToInt32(nId))
              {
                  return false;
              }
          }
          return true;
      }
  </code></pre>
  
  <p>My main question is, what if any are the recommended patterns for solving this issue?  Resource based authentication for ids seem like it would be a very common issue but there is a distant lack of articles about it.</p>