title: How to make additional data available to ApiController method via Attribute (AuthorizeAttribute)
body: <p>Our Web API will require consumers of the API to provide an API key we assign to them. The API key will be used for authorization and will be used to add data (somewhere, somehow) so that the ApiController's methods will have access to them.</p>
  
  <p>I'm considering creating an AuthorizationAttribute that</p>
  
  <ul>
  <li>checks that the API key is present</li>
  <li>verifies the supplied API key is valid for the incoming request (referrer)</li>
  <li><em>If the API key is present and valid, it will be used to get data such as ClientId and ClientName and add it to the incoming Request's Properties collection for use by methods in the ApiController. We might encode the ClientId, etc. into the API key and decode it server-side or retrieve it from the database.</em></li>
  </ul>
  
  <p>In my dummied-up custom AuthorizationAttribute, if authorization succeeds, I add clientId and clientName to the current Request by doing the following:</p>
  
  <pre><code>actionContext.Request.Properties.add("clientId", 1234);
  actionContext.Request.Properties.add("clientName", "Super Client");
  </code></pre>
  
  <p>Then within a method in the ApiController I grab the data by using:</p>
  
  <pre><code>int clientId = (int)Request.Properties["clientId"];
  string clientName = (string)Request.Properties["clientName"];
  </code></pre>
  
  <p>This works, but it assumes that "clientId" and "clientName" exists in <code>Request.Properties</code>. We can do checks with <code>Request.Properties.ContainsKey</code> but I don't want to repeat this checking code in every method in our Web API. I suppose I can have yet another attribute that does the check and if it fails to find them in <code>Request.Properties</code> returns a 500 Internal Server Error (Bad Request 400?).</p>
  
  <p>Or we could have the AuthorizationAttribute perform the authorization and then make a single call - in each ApiController method - to return an Client object with the data required given the API key supplied in the JSON payload. At this point we know the API key is valid so we'll get data the controller requires to process the request.</p>
  
  <p>What is a recommended approach for adding data to the Request for access by our ApiController's methods? Data that is required but is based off a valid API key being supplied (either we'll grab the data from the database or it'll be encoded into the public API key and decoded on our server). And that will:</p>
  
  <ul>
  <li>preferably not violate DRY (checking that the data the ApiController requires has been added and their respective values the right type)</li>
  <li>ensures that the values are present and the methods can execute without raising an exception</li>
  <li>should this be broken into two attributes? One that does the authorization, the next that gets the data needed based on the supplied API key? </li>
  </ul>
  
  <p>We are running Visual Studio 2010, MVC 4, .NET 4. The API key is to be supplied as part of a JSON payload to the web api.</p>
  
  <p>Magic strings will go away  ;-)</p>