Authenticating WCF DataServices

Question

Hi,

I am trying to authenticate calls to a WCF DataServices service via Silverlight. Essentially, when a user logs in they get a special hash which should be embedded in the headers of every request to the WCF DataServices. Currently use this as a check via a QueryInterceptor method eg

    [QueryInterceptor("Orders")]
    public Expression<Func<Orders,bool>> OnQueryOrders()
    {
        string hash = WebOperationContext.Current.IncomingRequest.Headers.Get("MyHeader");

        if(!TestHash(hash))
        {
            return o => false;
        }
        else
        {
            return o => true;
        }
    }

This seems like the WORST way to achieve this. Is there any hook in WCF Dataservices the runs before a query is run that you can use to cancel a request? Bear in mind this service is stateless and has no access to session.

Answer 1

Actually I think I resolved this issue myself. By overriding the OnStartProcessingRequest I can throw an exception if it doesn't suit e.g.

    protected override void OnStartProcessingRequest(ProcessRequestArgs args)
    {
        if (string.IsNullOrEmpty(WebOperationContext.Current.IncomingRequest.Headers.Get("MyMagicHeader")))
        {
            throw new DataServiceException(404, "Access denied!");
        }
        else
        {
            base.OnStartProcessingRequest(args);
        }
    }

Answer 2

Have you considered WCF Message Inspectors? I think (not guaranteed) the message inspector will be hit before the query interceptor so and you can inspect the headers and verify the users hashed value. Here's a good link with info on Writing Message Inspectors