title: ServiceStack Authorization - Access Route Information
body: <p>In the documentation for ServiceStack, it says that the best practice is:</p>
  
  <blockquote>
    <p>Normally ServiceStack calls the method bool HasPermission(string
    permission) in IAuthSession. This method checks if the list
    List Permissions in IAuthSession contains the required
    permission.</p>
    
    <p>IAuthSession is stored in a cache client as explained above You can
    fill this list in the method OnAuthenticated you've overriden in the
    first part of this tutorial.</p>
  </blockquote>
  
  <p>I am integrating with an existing system, and have my custom BasicAuthProvider working (inherited from the base BasicAuthProvider).  Authentication is working perfectly, now I am building out the Authorization portion.  I plan on using the Permissions list as listed above, but I need access to the Route information to determine if a user has access to a particular resource.  I see in the IAuthServiceBase there is an IRequestContext which has the absolute URL, but before going through and parsing that out, I figured there has to be a way to gain access to the ServiceStack Route structure to give me either the class name of the Service being requested, or the DTO the requested service is related to.  </p>
  
  <p>Here is the OnAuthenticated method from my BasicAuthProvider class:</p>
  
  <pre><code>public override void OnAuthenticated(IServiceBase authService, IAuthSession session, IOAuthTokens tokens, Dictionary&lt;string, string&gt; authInfo)
      {
  
  
          UserSession sess = (UserSession)session;
  
          Model.User currentUser = UserRepository.GetUserByUsername(session.UserAuthName);
  
          //Fill the IAuthSession with data which you want to retrieve in the app eg:
          session.FirstName = currentUser.Person.FirstName;
          session.LastName = currentUser.Person.LastName;
          session.UserName = currentUser.User1;
          sess.CurrentUser = currentUser;
          //Important: You need to save the session!
          authService.SaveSession(session, TimeSpan.FromDays(1));
      }
  </code></pre>
  
  <p>Under MVC I have used some of the Raw Request Data to get the Controller and Action name before, to determine resource authorization, but this is the first project I am using ServiceStack with.</p>