Adding a Key Check to all attempts to access any functions in a WebService

Question

I am building a Web Service API to provide remote access data from a management system.

There are various functions in the API and all require an access key.

I am currently wrapping the insides of all functions like this:

Function GETSOMETHING(api_key)
    If IntegratedApis.Grant_Api_Access(api_key) Then
        /// DO STUFF
    Else
        Return "API KEY not provided or incorrect"
    End
 End Function

Obviously my IntegratedApis.Grant_Api_Access(api_key) function returns a boolean output and checks the user's key in the database

This works, but the problem is it's a bit of a maintenance pain. How can I automatically wrap this around ALL calls to the webservice?

Is it possible via the global.asax file to return the error on Application_BeginRequest for example?

@JamieHartnoll: not the tool. what technology are you using? http://www.asp.net/web-api — Afshin Gh, Aug 13 '13 at 18:10
Sorry, I am totally new to all this. I am using an ASMX webservice, coding in VB. I'll read up some more... — Jamie Hartnoll, Aug 13 '13 at 18:37
ASMX is a legacy technology, and should not be used for new development. WCF should be used for all new development of web service clients and servers. One hint: Microsoft has retired the [ASMX Forum](http://social.msdn.microsoft.com/Forums/en-US/asmxandxml/threads) on MSDN. — John Saunders, Aug 13 '13 at 19:02

score 0 · Answer 1 · edited May 23 '17 at 10:31

Look for Aspect Oriented Programming (AOP) frameworks for .NET. These frameworks basically intercept all calls and run them through a function that relies heavily on reflection.

For example:

// Original function call that you want routed through AOP.
[KeyCheck]
public void OriginalFunctionCall() {
     ...
}

// AOP function that accepts all functions that were decorated with [KeyCheck].
// Runs logic before the function, runs the function, runs logic after.
public void Intercept() {
    // Before original function.
    keyCheck();

    // Original function
    functionCall();

    // Logic after original function.
    cleanUp();
}

Some of the frameworks let you put an annotation on all calls you want routed through the AOP framework. When I've used this approach, you have any logic you want performed before your call executed, then the call is executed, then any logic you want performed after the original call.

Some .NET AOP frameworks:

Last note: Be careful with performance. Some of the frameworks - since they use reflection heavily - can slow down your code.

Adding a Key Check to all attempts to access any functions in a WebService

1 Answers1