You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Breaking: Removed access-control action filter attributes such as HttpReadOnly, NoHttpPost etc. because they interfere with relationship endpoints. For example, blocking POST would block creating resources, as well as adding to to-many relationships, which is not very useful. The replacement is to inject just the subset of exposed services, or simply use the Command/Query controllers. When an endpoint is not exposed, we now return HTTP 403 Forbidden instead of 404 or 405.
Copy file name to clipboardExpand all lines: docs/usage/extensibility/controllers.md
+25-59Lines changed: 25 additions & 59 deletions
Original file line number
Diff line number
Diff line change
@@ -13,83 +13,49 @@ public class ArticlesController : JsonApiController<Article, Guid>
13
13
}
14
14
```
15
15
16
+
If you want to setup routes yourself, you can instead inherit from `BaseJsonApiController<TResource, TId>` and override its methods with your own `[HttpGet]`, `[HttpHead]`, `[HttpPost]`, `[HttpPatch]` and `[HttpDelete]` attributes added on them. Don't forget to add `[FromBody]` on parameters where needed.
17
+
16
18
## Resource Access Control
17
19
18
-
It is often desirable to limit what methods are exposed on your controller. The first way you can do this, is to simply inherit from `BaseJsonApiController` and explicitly declare what methods are available.
20
+
It is often desirable to limit which routes are exposed on your controller.
19
21
20
-
In this example, if a client attempts to do anything other than GET a resource, an HTTP 404 Not Found response will be returned since no other methods are exposed.
22
+
To provide read-only access, inherit from `JsonApiQueryController` instead, which blocks all POST, PATCH and DELETE requests.
23
+
Likewise, to provide write-only access, inherit from `JsonApiCommandController`, which blocks all GET and HEAD requests.
21
24
22
-
This approach is ok, but introduces some boilerplate that can easily be avoided.
25
+
You can even make your own mix of allowed routes by calling the alternate constructor of `JsonApiController` and injecting the set of service implementations available.
26
+
In some cases, resources may be an aggregation of entities or a view on top of the underlying entities. In these cases, there may not be a writable `IResourceService` implementation, so simply inject the implementation that is available.
The next option is to use the ActionFilter attributes that ship with the library. The available attributes are:
51
-
52
-
-`NoHttpPost`: disallow POST requests
53
-
-`NoHttpPatch`: disallow PATCH requests
54
-
-`NoHttpDelete`: disallow DELETE requests
55
-
-`HttpReadOnly`: all of the above
39
+
For more information about resource service injection, see [Replacing injected services](~/usage/extensibility/layer-overview.md#replacing-injected-services) and [Resource Services](~/usage/extensibility/services.md).
56
40
57
-
Not only does this reduce boilerplate, but it also provides a more meaningful HTTP response code.
58
-
An attempt to use one of the blacklisted methods will result in a HTTP 405 Method Not Allowed response.
41
+
When a route is blocked, an HTTP 403 Forbidden response is returned.
Finally, you can control the allowed methods by supplying only the available service implementations. In some cases, resources may be an aggregation of entities or a view on top of the underlying entities. In these cases, there may not be a writable `IResourceService` implementation, so simply inject the implementation that is available.
75
-
76
-
As with the ActionFilter attributes, if a service implementation is not available to service a request, HTTP 405 Method Not Allowed will be returned.
77
-
78
-
For more information about resource service injection, see [Replacing injected services](~/usage/extensibility/layer-overview.md#replacing-injected-services) and [Resource Services](~/usage/extensibility/services.md).
0 commit comments