Question

I need to run a validation routine looking for some header information on every request to the server. I would use OnActionExecuting in ASP.NET MVC, or an ActionInvoker, to run on every request, but I’ve been looking in Web API, and haven’t found something specific.

If something could be implemented for both synchronous and asynchronous, that would be the best.

Answer 1

For Web API you should resort to MessageHandlers

Message handlers always run first, before anything else in the pipeline, and they are also able to run last (after Web API returns response, just prior to the response reaching the client).

More about message handlers can be found here – http://www.asp.net/web-api/overview/working-with-http/http-message-handlers.

And here is a simple example, validating an API key:

public class WebApiKeyHandler : DelegatingHandler
{
    protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        string apikey = HttpUtility.ParseQueryString(request.RequestUri.Query).Get("apikey");
        if (apikey != "something")
        {
            HttpResponseMessage response = request.CreateErrorResponse(HttpStatusCode.Forbidden, "You can't use the API without the key.");
            throw new HttpResponseException(response);
        }
        else
        {
            return base.SendAsync(request, cancellationToken);
        }
    }
}

In this example only request with the key “something”: i.e./api/values/?apikey=something will be allowed, all other will be rejected.

In your case, you can simply access the request.Headers and validate whatever you need.