Introduction

Say we have an endpoint that must perform an action only if one has elevated permissions (i.e. delete some entity).
  1. let delete (id: string) =
  2. fun (next: HttpFunc) (httpContext : HttpContext) ->
  3. let result =
  4. AuthApi.authorize httpContext
  5. |> Result.bind (fun _ -> ElasticAdapter.deleteRoute id)
  6. match result with
  7. | Ok _ -> text "" next httpContext
  8. | Error "ItemNotFound" -> RequestErrors.BAD_REQUEST "" next httpContext
  9. | Error "Forbidden" -> RequestErrors.FORBIDDEN "" next httpContext
  10. | Error _ -> ServerErrors.INTERNAL_ERROR "" next httpContext
Note that in a discriminated union we match multiple error cases, and one of them is a Forbidden case
Now let's have a look at the code of the authorize method inside AuthApi
  1. let authorize (httpContext : HttpContext) =
  2. let authorizationHeader = httpContext.GetRequestHeader "Authorization"
  3. let authorizationResult =
  4. authorizationHeader
  5. |> Result.bind JwtValidator.validateToken
  6. authorizationResult
And here's the JtwValidator
  1. module JwtValidator
  3. open Microsoft.IdentityModel.Tokens
  4. open System.Text
  5. open System.IdentityModel.Tokens.Jwt
  6. open System
  8. let key = "<your key>"
  10. let createValidationParameters =
  11. let validationParameters = TokenValidationParameters()
  12. validationParameters.ValidateAudience <- false
  13. validationParameters.ValidateLifetime <- true
  14. validationParameters.ValidateIssuer <- false
  15. validationParameters.IssuerSigningKey <- SymmetricSecurityKey(Encoding.UTF8.GetBytes(key))
  16. validationParameters
  18. let validateToken (token: string) =
  19. try
  20. let tokenHandler = JwtSecurityTokenHandler()
  21. let validationParameters = createValidationParameters
  22. let mutable resToken : SecurityToken = null
  23. tokenHandler.ValidateToken(token, validationParameters, &resToken)
  24. |> ignore
  25. Result.Ok()
  26. with
  27. | _ -> Result.Error "Forbidden"