Question

I’m now building a App that use asp.net webAPI on the server side,I got a problem about the validation:

I want to provide my webAPI for multi-platform,just like browser’s javascript,or windows phone ,and so on,so I decide to implicit the validation with HTTP-BASIC,”(forgive my poor English),the problem is ,In the past time.

I always take some User’s Information in SESSION,but we know that webAPI with RESTful-style is Session-stateless,so how to store the User’s information:

And I get some idea,I hope you can help me to make the right choice,thx a lot

1.
put the information into the browser’s cookie except the user’s password and other important infos. everytime I make the http-request ,i take the cookies.and on the server-side,I can query the user’s infomation.and make other steps.(the sequence will not work on moblie platform,cuz cookies only in browsers)

2.user HTTP-BASIC validation,and everytime the server get the httpRequest,it get the username and password in the HTTP-Headers,and server-side also can query the user’s information.

Answer 1

Most REST APIs I’ve seen handle authentication one of two ways:

1. HTTP Headers, be it basic auth, or some custom headers to pass credentials. This would be your option 2. This is only really good if you’re running over HTTPS, since the credentials will be in clear text in the headers.
2. Using a pair of tokens, one as an identifier (somewhat like a user name) and one shared secret between the client and the server (somewhat like a password). A hash is then made of the identifier, parts of the request parameters, and the secret. This hash and the identifier is then sent along with the request. The server, knowing the secret, then computes the hash using the same method, and ensures they match (Amazon Web Services uses this method, along with anything using OAuth).

More web APIs seem to be migrating to the second method here, as it is resistant to tampering and replay attacks, unlike basic auth. It is, of course, more complex.

RFC 5849 Section 3.4 for OAuth, while dry reading, goes through the process used for creating the hash, and probably would be a good starting point for implementing, if you desire. A basic implementation in C# is provided on the OAuth Google Code site, and might be a better choice to start with.