Question

I have a Backbone/RequireJS application built on top of .NET MVC4. I am using Forms Authentication to authenticate the user against our back end data store, and this is working great.

Our services layer is a .NET Web Api Project (RESTful API), and is using a tokenized approach to auth (initial request includes basic auth header. If auth is successful, response payload includes authentication token. Subsequent requests pass the token).

What I’m not sure about is how to now authenticate against our services layer. I’m sure I’ll have to pass the auth header, but not sure how to generate the token, as I won’t have username/password in my JS.

Should I bypass Forms auth altogether here, and simply make an ajax request over SSL? I can POST to the /Account/Login action just as well, and use the Membership Provider to validate credentials. If successful, I can add the Auth header for initial request & use auth token for subsequent requests.

Example of adding auth header / custom token here:

$.ajaxSetup({
    'beforeSend': function (xhr) {
        if($.cookie("AuthToken")) {
            xhr.setRequestHeader("CustomTokenHeader", $.cookie("AuthToken"));
        } else {
            var token = methodToBase64EncodeUsernamePassword(username, password);
            xhr.setRequestHeader("Authentication", "Basic " + token);
        }

    }
});

Answer 1

Take a look at this solution, which is based off a screencast I cannot seem to find again. If I can find it, I will update the answer. You should be able to follow the solutions easily though. The one you are looking for is PerRouteMHOwnershipSample. I believe the best practice is to ‘bypass Forms auth altogether here, and simply make an ajax request over SSL’. Any api route you want to secure, will be filtered and a token will then need to be passed from your app and decoded on the server. I would personally not look at using Forms Authentication to secure your api.