title: Accessing QueryString in a custom AuthorizeAttribute
body: <p>I am using Web API and have setup a simple authentication and authorization mechanism where the caller passes a token that I have issued to them in the query string.  So they submit a request like:</p>
  
  <pre><code>https://mysite.com/api/Ping?token=[issued-token]
  </code></pre>
  
  <p>I have an ApiAuthorizeAttribute like this:</p>
  
  <pre><code>public class ApiAuthorizeAttribute : System.Web.Http.AuthorizeAttribute
  {
      public ApiPermission Permission { get; set; }
  
      public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
      {
          switch (Permission)
          {
              case ApiPermission.None: 
                 return;
  
             case ApiPermission.Write:
             case ApiPermission.Read:
  
                 string query = actionContext.Request.RequestUri.Query;
                 var nvc = System.Web.HttpUtility.ParseQueryString(query);
                 string token = nvc["token"];
  
                 // (my code to map the token to an Authorization for the request)               
                 ApiAuthorization auth = ApiToken.GetAuthorization(token);
                 if (auth != null &amp;&amp; auth.HasPermission(Permission))
                     return;
  
                 HandleUnauthorizedRequest(actionContext);
                 return;
  
             default:
                 throw new ArgumentException("Unexpected Permission");
          }
      }
  }
  </code></pre>
  
  <p>Then I can decorate my APIs like this.  Note: this is just an example, a real call would read data from their account (an account identifier is encrypted within their token) and return it.</p>
  
  <pre><code>/// &lt;summary&gt;
  /// Ping service that requires a Token with Read permission
  /// Returns "Success!"
  /// &lt;/summary&gt;
  [ApiAuthorize(Permission = ApiPermission.Read)]
  [HttpGet]
  public string Ping()
  {
      return "Success!";
  }
  </code></pre>
  
  <p>As you might note, I could not access the QueryString anywhere from HttpActionContext parameter and had to build it myself.  It seems like they explicitly removed QueryString from this Request object.  I don’t want to add “token” it to each and every API method in order to get it in the Route Data.</p>
  
  <p>So my questions are:</p>
  
  <ol>
  <li>Is the QueryString in there somewhere and I am just missing it?  If not, any idea why Microsoft doesn't include it with this Request object?  (i.e. maybe this is a bad thing to do?)</li>
  <li>Is there a better way to deal with getting the token in the AuthorizeAttribute (again, without adding it to each call)?</li>
  </ol>
  
  <p>BTW, I realize there are other (probably better) options for authorization such as Basic Authentication and OAuth, and I do not want to debate that topic here. </p>