Question

Say I have a xml like the following which gets posted to an api controller:

<request>
<header><api_key>Somekey</api_key></header>
</request>

If I want to validate the api key in a custom AuthorizationFilterAttribute like so:

public override void OnAuthorization(HttpActionContext actionContext)
{
    // Deserialize the posted message and validate the api key.
}

How can I do that without having to manually deserialize it?

Answer 1

What do you mean you don’t wnat to “manually deserialize it”? Are you referring to the automatic modelbinding that the controllers support? If so, you won’t be able to take advantage of those at that point in the pipeline.

To echo peco’s comment, you shouldn’t be putting an api key in the body but rather in the header or querystring.