title: How to override HttpGet/HttpPost in Asp.net MVC 5 ApiController
body: <p>I would like to override the API Controller to check for certain values in the header on all HttpGet and HttpPost calls as they're made without including the code for the check in every single call. Currently my method looks like:</p>
  
  <pre><code>public class MyApiController : ApiController
  {
      [HttpGet]
      public HttpResponseMessage GetAccountById()
      {
          var accountId = (Request.Headers.Where(t =&gt; t.Key == "accountid").Count() == 0) ? null : Request.Headers.GetValues("accountid").First();
          var apiKey = (Request.Headers.Where(t =&gt; t.Key == "apikey").Count() == 0) ? null : Request.Headers.GetValues("apikey").First();
  
          if (String.IsNullOrEmpty(accountId)) {
                  return Request.CreateResponse(HttpStatusCode.Forbidden, "Please provide an Account Id.");
          }
  
          if (String.IsNullOrEmpty(apiKey)) {
                  return Request.CreateResponse(HttpStatusCode.Forbidden, "Please provide an Account Api Key.");
          }
  
          // Get Account
          // return Account;
      }
  }
  </code></pre>
  
  <p>How can I do that apikey/accountid check in every call without having to write the check into every call?</p>
  
  <p>SOLUTION: Overriding the DelegatingHandler worked perfectly.</p>
  
  <p><strong>ApiSecurityHandler.cs</strong></p>
  
  <pre><code>public class ApiSecurityHandler : DelegatingHandler
  {
      public ApiSecurityHandler(HttpConfiguration httpConfiguration)
      {
          InnerHandler = new HttpControllerDispatcher(httpConfiguration); 
      }
  
      protected override Task&lt;HttpResponseMessage&gt; SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
      {
          var accountId = (request.Headers.Where(t =&gt; t.Key == "accountid").Count() == 0) ? null : request.Headers.GetValues("accountid").First();
          var apiKey = (request.Headers.Where(t =&gt; t.Key == "apikey").Count() == 0) ? null : request.Headers.GetValues("apikey").First();
  
          if (String.IsNullOrEmpty(accountId)) {
              var response = new HttpResponseMessage(HttpStatusCode.Forbidden);
              response.Content = new StringContent("Please provide an Account Id.");
  
              var tsc = new TaskCompletionSource&lt;HttpResponseMessage&gt;();
              tsc.SetResult(response);
              return tsc.Task;
          }
  
          if (String.IsNullOrEmpty(apiKey)) {
              var response = new HttpResponseMessage(HttpStatusCode.Forbidden);
              response.Content = new StringContent("Please provide an Account Api Key.");
  
              var tsc = new TaskCompletionSource&lt;HttpResponseMessage&gt;();
              tsc.SetResult(response);
              return tsc.Task;
          }
  
          // Authorize the Account Id and Api Key here
          using (var accountManager = new AccountManager()) {
              if (!accountManager.AuthorizeAccountApiKey(accountId, apiKey)) {
                  var response = new HttpResponseMessage(HttpStatusCode.Forbidden);
                  response.Content = new StringContent("Api authorization denied.");
  
                  var tsc = new TaskCompletionSource&lt;HttpResponseMessage&gt;();
                  tsc.SetResult(response);
                  return tsc.Task;
              }
          }
  
          return base.SendAsync(request, cancellationToken);
      }
  }
  </code></pre>
  
  <p>And the in your routing config just add this parameter to the map route:</p>
  
  <pre><code>handler: new ApiSecurityHandler(GlobalConfiguration.Configuration)
  </code></pre>