I am doing a restful web api with asp.net Web API 2

I do not want to use any form of cookies or basic authentication (send user/pass in cleartext thus SSL needed)

I do not use/need claims stuff.

I have not decided yet about asp.net self hosting or IIS.

I just want to send an encrypted token between client server via SSL.

I am using Entity framework 6, .NET 4.5.1 and I just want to do CRUD-actions on my user table.

Not more.

What is the project template/library/approach I should start with to do the above?

  • Take a look at OAuth 2.0 oauth.net/2 It may seem a little overkill initially but I'm sure you'll find what you are looking for in there. Dec 27, 2013 at 3:25

1 Answer 1


Use HMAC with a client ID.

The client uses their "secret" salt to sign the message and then send the server the generated hash along with its ID. The server looks up what the "secret" should be based on the ID the client sent, regenerates the hash with the fetched secret as the salt. If the server-generated hash matches the client-provided hash, then the request is legitimate.

I'm not a ASP/.NET person, so I can't provide any info on libs nor technical approach, but here's some pseudo code:


var messageBody = 'POST PLAIN TEXT BODY';
var clientId = '12345';
var secret = 'abcdef';
var digest = createHash(messageBody,secret); // function createHash(string,salt)
var url = 'http://example.org/api?clientId='+clientId+'&hmac='+digest;
sendRequest(url,messageBody); // function sendRequest(url,postbody)


var messageBody = 'POST PLAIN TEXT BODY';
var clientId = '12345'; // from GET query
var hmac = '...'; // from GET query
var secret = lookupSecret(clientId);
var digest = createhash(messageBody,secret);
if ( hmac == digest ) {
    // success, handle messageBody
} else {
    // error

Consider using a nonce to prevent man-in-the-middle attacks, if that is of concern to you.

  • 1
    Should not SSL prevent man in the middle attacks?!
    – Pascal
    Dec 27, 2013 at 9:07
  • @Pascal Yes SSL will prevent MITM (except for cases outlined in this SO answer: stackoverflow.com/a/14907718/1481489), however I originally misunderstood part of your question and assumed you weren't using SSL since you did not want to send plaintext username/password credentials (which is not the case per the second half of your question). It is worth noting that a nonce is also beneficial in the context of preventing repeat transactions since a nonce can only be used (n)once, although I'd say you shouldn't pragmatically rely on this "feature."
    – zamnuts
    Dec 27, 2013 at 10:01
  • Nono I will have to use OR I want to use SSL when I use basic auth everything else would be stupid even for an online edu platform no big secure $$$ cloud service whatever. I think I will go first for basic auth and put later SSL on it. About the the digest/hash stuff I am not sure yet wether I will need/use it.
    – Pascal
    Dec 27, 2013 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.