Authorization and Authentication design for splitting a site into REST API and Web App (AspNetCore MVC)

Question

I am considering splitting a project from monolithic to server side REST API plus isolated web-based front end (or, also, any other third party consumer) that can be hosted on a distinct server and domain.

How should I approach user authentication and authorization? Forms authentication is basically gone, and all calls would be handled the same way to API endpoints, whether they originate from our web app, or a third party app.

The server side REST API is going to be the gatekeeper and only allow access conditionally. I would use standard C# ASP.Net membership ideally. Framework would be ASPNetCore with MVC 6.

Answer 1

First of all, ASP.NET Core doesn't have support for Membership anymore, you would have to use Identity.

I recently came across such requirement myself as our applications were growing and, each time, we had to implement membership/identity for each of them.

The solution i came up with was to build a centralized authentication server which will accept user credentials, connect to database, authenticate the credentials and generate/return tokens (JWT). This token will serve the purpose of both authentication and authorization through claims. Only this application/server will implement identity.

On any client application with protected resources (Authorize), they would have to implement a middleware which will read the token and validate the claims. There is no requirement for the middleware to connect to the database again to validate the claims. This token will be appended to the Authorization header every time a request is made to a protected resource.

Every time you create a new application which will use the same authentication server, all you need to do is to implement/inject the validation middleware. There is no need to re-implement identity again.

Refer below resources for basics & implementation details.

References:

1. https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity
2. https://docs.microsoft.com/en-us/aspnet/core/security/authorization/claims
3. https://stormpath.com/blog/token-authentication-asp-net-core
4. https://jwt.io/

Additional Resources once you are through with the basics:

1. https://stackoverflow.com/questions/18223868/how-to-encrypt-jwt-security-token/44195678#comment75530351_44195678
2. https://stackoverflow.com/questions/44179525/asp-net-core-jwt-bearer-token-custom-validation/44320206#44320206

Note: In my scenario, all applications interact with the same database.

Answer 2

It's definitely a good idea to separate frontend and backend. For the authentication & authorization, there is a project which uses angular5 as frontend and asp.net core as backend. It uses aspnetcore.Identity and OpenIdConnect. Hopefully you can find something with it.