Checking for IP address on all API calls #5738

7 Answer(s)

• 

  0

  maliming created 5 years ago

  Support Team

  I suggest you register a net core middleware, this is the highest priority.

  Save Cancel
• 

  0

  aaron created 5 years ago

  Support Team

  Answered in this SO question: Authorize application service based on client IP address

  Save Cancel
• 

  0

  vladsd created 5 years ago

  For all users, anonymous user and registered, I need to intercept all API calls and check against IP list in tenant table. The solutions above do not provide for it.

  Putting TenantManager reference in Startup causes issues InvalidOperationException: Unable to resolve service for type 'MyProject.MultiTenancy.TenantManager' while attempting to activate 'MyProject.Web.Startup.Startup'.

  //https://docs.microsoft.com/en-us/aspnet/core/fundamentals/middleware/?view=aspnetcore-2.1

             app.Use(async (context, next) =>
             {
                 // Do work that doesn't write to the Response.
                 if(! await _tenantManager.ValidateIPAddress())
                 {
                     throw new AbpAuthorizationException();
                 }
  
                 await next.Invoke();
             });
  

  Save Cancel
• 

  0

  ryancyq created 5 years ago

  Support Team

  you can inject TenantManager and use in Intercept()

  example from the SO post:

  internal class ClientIpAuthorizationInterceptor : IInterceptor
  {
      private readonly IClientInfoProvider _clientInfoProvider;
      private readonly ITenantManager _tenantManager;
  
      public ClientIpAuthorizationInterceptor(
          IClientInfoProvider clientInfoProvider,
          ITenantManager tenantManager
      )
      {
          _clientInfoProvider = clientInfoProvider;
          _tenanrManager = tenantManager;
      }
  
      public void Intercept(IInvocation invocation)
      {
          //more code
  
          //modify the following to check IP addresses from TenantManager
          if (clientIpAuthorizeAttribute != null &&
              clientIpAuthorizeAttribute.AllowedIpAddress != _clientInfoProvider.ClientIpAddress)
          {
              throw new AbpAuthorizationException();
          }
  
          invocation.Proceed();
      }
  }
  

  Do note that by reading ip addresses from tenant manager will impact the performance as this interception is triggerred for every web request.

  Save Cancel
• 

  0

  vladsd created 5 years ago

  @ryancyq sorry, it still does not solve my issue as I need IP check on all calls, now I need to add ClientIpAuthorize to all API calls! What about abp framework, I cannot access those like one for GetAll, etc.

  Save Cancel
• 

  0

  aaron created 5 years ago

  Support Team

  app.Use(async (context, next) =>
  {
      IocManager.Instance.Using<TenantManager>(async tenantManager =>
      {
          if (!await _tenantManager.ValidateIPAddress())
          {
              throw new AbpAuthorizationException();
          }
      });
  
      await next.Invoke();
  });
  

  Save Cancel
• 

  0

  vladsd created 5 years ago

  Better solution is to override AuthorizationHelper -> AuthorizeAsync method and check there

  Save Cancel