init

KretaWeb/Security/LocalRequestOnlyAttribute.cs

@@ -0,0 +1,29 @@
+using System.Threading;
+using System.Threading.Tasks;
+using System.Web.Http.Controllers;
+using System.Web.Http.Filters;
+
+namespace Kreta.Web.Security
+{
+    /// <summary>
+    /// Allow only local requests
+    /// </summary>
+    public class LocalRequestOnlyAttribute : ActionFilterAttribute
+    {
+        /// <summary>
+        /// Authorization event
+        /// </summary>
+        /// <param name="actionContext">Context of the current action</param>
+        /// <param name="cancellationToken">Cancellation token</param>
+        /// <returns></returns>
+        public override Task OnActionExecutingAsync(HttpActionContext actionContext, CancellationToken cancellationToken)
+        {
+            if (!actionContext.RequestContext.IsLocal)
+            {
+                actionContext.Response = new System.Net.Http.HttpResponseMessage(System.Net.HttpStatusCode.Forbidden);
+            }
+
+            return base.OnActionExecutingAsync(actionContext, cancellationToken);
+        }
+    }
+}