3

I have a webapi project working in production for few months now.

The entire webapi is server to server.

There is a need now to have the same functionality in a browser, meaning the customers can invoke via ajax functions directly on the webapi server.

Since the webapi is stateless and session usage is not really recommended, what are my options here?

Today (server to server), every request reaching the server has user and pass, and on every request there is a login check (not that efficient, I know).

What happens when the same rest webapi needs to go to the browser and have security?

closed as unclear what you're asking by GlenH7, Ixrec, user22815, durron597, user40980 Oct 7 '15 at 13:57

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

0

The most common way to provide security in a Web API application is through the usage of the built-in [Authorize] attribute. You can read more about authentication in Web API here. The Authorize attribute depends upon the ASP.NET membership or identity framework. Either the membership system or the identity system can be used. I would recommend the identity framework since it is newer and the model that will be supported going forward. You can read more about the ASP.NET identity framework here. A sample application that implements authorization and authentication using the ASP.NET identity framework can be found here. I will provide a few common examples.

To restrict access to all controllers/routes globally:

public static void Register(HttpConfiguration config)
{
    config.Filters.Add(new AuthorizeAttribute());
}

To restrict access on individual controllers:

// Require authorization for all actions on the controller.
[Authorize]
public class ValuesController : ApiController
{
    //Allow anonymous access on Get, but restrict all other actions
    [AllowAnonymous]
    public HttpResponseMessage Get(int id) { ... }
    public HttpResponseMessage Post() { ... }
}

To restrict access on specific actions:

public class ValuesController : ApiController
{
    // Anonymous access is allowed on Get
    public HttpResponseMessage Get() { ... }

    // Require authorization for Post.
    [Authorize]
    public HttpResponseMessage Post() { ... }
}

To restrict access to a specific role/user:

public class ValuesController : ApiController
{
    // Anonymous access is allowed on Get
    public HttpResponseMessage Get() { ... }

    // Require specific user access on Post
    [Authorize(Users="Bob,Joe")]
    public HttpResponseMessage Post() { ... }

    // Require specific role access on Delete
    [Authorize(Roles="Administrators")]
    public HttpResponseMessage Delete() { ... }
}
  • Thanks, isnt webapi by design is stateless? how can it support cookie / session? isnt that a violation of the entire concept? thanks – SexyMF Oct 6 '15 at 4:55
0

One option is to add authentication to your webapi server. Another option is you may already have a web server with authentication that is related to this webapi server. If so, you can use this server as a proxy to the webapi server, possibly using a facade pattern to simplify the interaction (https://en.wikipedia.org/wiki/Facade_pattern).

Not the answer you're looking for? Browse other questions tagged or ask your own question.