title: Web API OData Security per Entity
body: <p><strong>Background:</strong><br>
  I have a very large OData model that is currently using WCF Data Services (OData) to expose it.  However, Microsoft has stated that WCF Data Services is <a href="http://blogs.msdn.com/b/odatateam/archive/2014/03/27/future-direction-of-wcf-data-services.aspx" rel="noreferrer">dead</a> and that Web API OData is the way they will be going.</p>
  
  <p>So I am researching ways to get Web API OData to work as well as WCF Data Services. </p>
  
  <p><strong>Problem Setup:</strong><br>
  Some parts of the model do not need to be secured but some do.  For example, the Customers list needs security to restrict who can read it, but I have other lists, like the list of Products, that any one can view.</p>
  
  <p>The Customers entity has many many associations that can reach it.  If you count 2+ level associations, the are many hundreds of ways that Customers can be reached (via associations).  For example <code>Prodcuts.First().Orders.First().Customer</code>.  Since Customers are the core of my system, you can start with most any entity and eventually associate your way to the Customers list.</p>
  
  <p>WCF Data Services has a way for me to put security on a specific entity via a method like this:</p>
  
  <pre><code>[QueryInterceptor("Customers")]
  public Expression&lt;Func&lt;Customer, bool&gt;&gt; CheckCustomerAccess()
  {
       return DoesCurrentUserHaveAccessToCustomers();
  }
  </code></pre>
  
  <p>As I look at Web API OData, I am not seeing anything like this.  Plus I am very concerned because the controllers I am making don't seem to get called when an association is followed.  (Meaning I can't put security in the <code>CustomersController</code>.)</p>
  
  <p>I am worried that I will have to try to somehow enumerate all the ways that associations can some how get to customers and put security on each one.</p>
  
  <p><strong>Question:</strong><br>
  <strong>Is there a way to put security on a specific entity in Web API OData?</strong>  (Without having to enumerate all the associations that could somehow expand down to that entity?)</p>