Question

I’ve watched and viewed lots of pages on securing asp.net web api’s – including: http://weblogs.asp.net/jgalloway/archive/2012/03/23/asp-net-web-api-screencast-series-part-6-authorization.aspx and http://weblogs.asp.net/jgalloway/archive/2012/05/04/asp-net-mvc-authentication-customizing-authentication-and-authorization-the-right-way.aspx – however, I’ve not yet seen a KISS type example.

If I have a web api, which returns a list of cars for example – and I am working with a 3rd party (ie. not my own website or server/domain) who wants to query (get) and insert (post) lists of cars by a type, into my database, how so I authenticate them (via https)?

Do they simply add (into their JSON GET/Post) something like:

[
{"username":"someusername","password":"somepassword",
{
"carTypeID":12345,
"carTypeID":9876}
"carTypeID":2468}
}
}
]

I can then grab the username and password, and check against my membership database in .net, and “IfUserAuthenticated” go on to process the rest of the JSON?

Or is there a better way of doing this? I’ve heard of adding details to headers etc – but I’m not sure if that’s for a reason, or over complicating it. I’ve also heard of setting tokens which are sent back to the 3rd party – if that’s the best method, what instructions do I give them got building their side of the app that will use my API?

Thanks for any advice/pointers,

Mark

Answer 1

If you want to keep it simple you can use Basic authentication. Over SSL it’s quite secure. It simply involves adding a header to the request:

Authorization: Basic <username:password encoded as base64>

You can find a way to implement it here.