WebApiDoodle BasicAuthenticationHandler and WebApi 4 not Allowing Anonymous

Question

This a .NET 4.5 C# MVC + WebAPI 4 project. I am using the WebApiDoodle 2.0.1 BasicAuthenticationHandler to use MVC + WebAPI side by side security as explained here.

In my Application Start I add the Message Handler:

globalConfig.MessageHandlers.Add(new {MyClass Derived from BasicAuthenticationHandler}());

The MVC controllers work fine (classes derived from System.Web.Mvc.Controller).

However, the WebApi controllers (derived from System.Web.Http.ApiController) ignore the System.Web.Http.AllowAnonymous attribute. They basically want to authenticate/authorize everything.

If I remove the custom message handler from the globalConfig the WebAPI works as expected, the AllowAnonymous attribute allows anonymous requests to be served (and actions that have [Authorize] are denied).

Any ideas what might be happening? Thanks.

Pablo Cibraro Pablo Cibraro · Accepted Answer · 2013-04-11T18:39:31

It's look like a bug in that MessageHandler

https://github.com/WebAPIDoodle/WebAPIDoodle/blob/dev/src/WebApiDoodle.Web/MessageHandlers/BasicAuthenticationHandler.cs

If Authorization header is null, it's returning a challenge (www-challenge), so it never invokes the Web API. The challenge should only be returned if the web api method can not be executed because it requires authorization. It should have something like this,

    return base.SendAsync(request, cancellationToken)
.ContinueWith<HttpResponseMessage>(r =>
{
  if (r.Result.StatusCode == HttpStatusCode.Unauthorized)
  {
    return HandleUnauthenticatedRequestImpl(request, cancellationToken);
  }

  return r.Result;
});

Ask the project owner if he can fix the handler.

WebApiDoodle BasicAuthenticationHandler and WebApi 4 not Allowing Anonymous

2 Answers