3

I'm basically attaching a listener to an event that's triggered when a controller action completes. Said listener has a dependency that calls a 3rd party API client and do some action. I.e: creates a new document in google drive).

Following the example, if the user hasn't authorized through OAuth2, the system should redirect to the OAuth page. This action would be done by the listener.

Is this a bad design?

1

You risk needing to attach many many listeners for this authorization concern.

Ideally you would make it cross cutting, something that gets check before the controller creating the google drive document gets invoked. If your framework does no provide any means to do this then I would explicitly add 'am I authorized to do this?' invocations at the controller and not use listeners.

When not authorized, the controller can error out with 'not authorized' which can be caught globally somehow to trigger the redirect.

3

Yes.

The proper way to do this is with an Authorize attribute on the controller action method.

  • 1
    Thanks for answer. However, I'm not using .NET so I'm not sure what "component" is this attribute. Is it a middleware or similar? – Christopher Francisco Jan 25 '17 at 21:51
  • Think of .NET attributes as meta data that the framework can read before calling the method. The key thing to understand is that you should look at how your web framework supports doing authentication. You really should deal with any authentication issues before you do any work. – Michael Shaw Jan 26 '17 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.