Q:

Get the value of authorization bearer in Service stack

I have following scenario ,
Mobile client --->Service stack api(A) --->A Wcf service(B)
I am sending an access token from mobile client as Http Authorization header to service stack api (B)I don't need to use service stack build in Auth providers since my service stack api (A) is only  a middle api for WCF service(B).
I am sending Authorization header as HttpRequestMessageProperty to the WCF service(B). I am handling rest of the validations in wcf service side(B).

How i can get the "access token" which is send by the mobile client
in service stack side(A) and just pass to other service(B)I
couldn't find a proper documentation about this .
If i get security exception from service(B) how can i effectively
manage it in service stack side (A). Ideally i wish to check the
exception in a single place ,if it is a Security Exception i wish
to return 401 to mobile client with response
What is the effective way to manage token or credentials or other
user related things within service Stack side?Something like session
?

Any one have any idea ?

A:

The way to access any HTTP Request information is to use the IRequest interface which is available everywhere, as an argument in all Request and Response Filters and Filter Attributes, from the base.Request property in Services and Razor Views, etc.
The Authorization HTTP Request Header is accessible from the HTTP Request Headers collection, e.g:
var auth = httpReq.Headers[HttpHeaders.Authorization];

If you want to handle this generically for all requests you'd typically use a Global Request Filter which you could use to validate whether a valid Authorization header was sent and it was valid otherwise return a HTTP Error Response, e.g:
this.GlobalRequestFilters.Add((req, res, requestDto) => {
    var auth = req.Headers[HttpHeaders.Authorization];
    if (auth == null)
    {
        res.StatusCode = (int)HttpStatusCode.Unauthorized;
        res.EndRequest();
    }
    else if (!MyIsValid(auth))
    {
        res.StatusCode = (int)HttpStatusCode.Forbidden;
        res.EndRequest();
    }
});

