Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

ASP.NET Web API Security Essentials

By : Gunasundaram

2.3 (3)

ASP.NET Web API Security Essentials

2.3 (3)

By: Gunasundaram

Overview of this book

This book incorporates the new features of ASP.NET Web API 2 that will help you to secure an ASP.NET Web API and make a well-informed decision when choosing the right security mechanism for your security requirements. We start by showing you how to set up a browser client to utilize ASP.NET Web API services. We then cover ASP.NET Web API’s security architecture, authentication, and authorization to help you secure a web API from unauthorized users. Next, you will learn how to use SSL with ASP.NET Web API, including using SSL client certificates, and integrate the ASP.NET Identity system with ASP.NET Web API. We’ll show you how to secure a web API using OAuth2 to authenticate against a membership database using OWIN middleware. You will be able to use local logins to send authenticated requests using OAuth2. We also explain how to secure a web API using forms authentication and how users can log in with their Windows credentials using integrated Windows authentication. You will come to understand the need for external authentication services to enable OAuth/OpenID and social media authentication. We’ll then help you implement anti-Cross-Site Request Forgery (CSRF) measures in ASP.NET Web API. Finally, you will discover how to enable Cross-Origin Resource Sharing (CORS) in your web API application.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Reader feedback

Customer support

Free Chapter

1. Setting up a Browser Client

1. Setting up a Browser Client

ASP.NET Web API security architecture

Setting up your browser client

Authentication and authorization

Implementing authentication in HTTP message handlers

Setting the principal

Using the [Authorize] attribute

Custom authorization filters

Authorization inside a controller action

Summary

2. Enabling SSL for ASP.NET Web API

2. Enabling SSL for ASP.NET Web API

Enforcing SSL in a Web API controller

Using client certificates in Web API

Summary

3. Integrating ASP.NET Identity System with Web API

3. Integrating ASP.NET Identity System with Web API

Creating an Empty Web API Application

Installing the ASP.NET Identity NuGet packages

Setting up ASP.NET Identity 2.1

Defining Web API Controllers and methods

Summary

4. Securing Web API Using OAuth2

4. Securing Web API Using OAuth2

Hosting OWIN in IIS and adding Web API to the OWIN pipeline

Individual User Account authentication flow

Sending an unauthorized request

Get an access token

Send an authenticated request

Summary

5. Enabling Basic Authentication using Authentication Filter in Web API

5. Enabling Basic Authentication using Authentication Filter in Web API

Basic authentication with IIS

Basic authentication with custom membership

Basic authentication using an authentication filter

Setting an authentication filter

Implementing a Web API authentication filter

Setting an error result

Combining authentication filters with host-level authentication

Summary

6. Securing a Web API using Forms and Windows Authentication

6. Securing a Web API using Forms and Windows Authentication

Working of Forms authentication

Implementing Forms authentication in Web API

What is Integrated Windows Authentication?

Advantages and disadvantages of using the Integrated Windows Authentication mechanism

Configuring Windows Authentication

Difference between Basic Authentication and Windows authentication

Enabling Windows authentication in Katana

Summary

7. Using External Authentication Services with ASP.NET Web API

7. Using External Authentication Services with ASP.NET Web API

Using OWIN external authentication services

Implementing Facebook authentication

Implementing Twitter authentication

Implementing Google authentication

Implementing Microsoft authentication

Discussing authentication

Summary

8. Avoiding Cross-Site Request Forgery Attacks in Web API

8. Avoiding Cross-Site Request Forgery Attacks in Web API

What is a CSRF attack?

Anti-forgery tokens using HTML Form or Razor View

Anti-forgery tokens using AJAX

Summary

9. Enabling Cross-Origin Resource Sharing (CORS) in ASP.NET Web API

9. Enabling Cross-Origin Resource Sharing (CORS) in ASP.NET Web API

What is CORS?

How CORS works

Setting the allowed origins

Setting the allowed HTTP methods

Setting the allowed request headers

Setting the allowed response headers

Passing credentials in cross-origin requests

Enabling CORS at various scope

Summary

Index

Index

Using the [Authorize] attribute

AuthorizeAttribute will make sure if the user is authenticated or unauthenticated. Unauthorized error with HTTP status code 401 will be returned if the user is not authenticated and the corresponding action will not be invoked. Web API enables you to apply the filter in three ways. We can apply them at global level, or at the controller level, or at the individual action level.

Global authorization filter

To apply authorization filter for all Web API controllers, we need to add the AuthorizeAttribute filter to the global filter list in the Global.asax file as given below:

public static void Register(HttpConfiguration config)
{
    config.Filters.Add(new AuthorizeAttribute());
}

Controller level authorization filter

To apply an authorization filter for a specific controller, we need to decorate the controller with filter attribute as given in the following code:

// Require authorization for all actions on the controller.
[Authorize]
public class ContactsController : ApiController
{
    public IEnumerable<Contact> GetAllContacts() { ... }
    public IHttpActionResult GetContact(int id) { ... }
}

Action level authorization filter

To apply an authorization filter for specific actions, we need to add the attribute to the action method as given in the following code:

public class ContactsController : ApiController
{
    public IEnumerable<Contact> GetAllContacts() { ... }

    // Require authorization for a specific action.
    [Authorize]
    public IHttpActionResult GetContact(int id) { ... }
}

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

ASP.NET Web API Security Essentials

Search

Your notes and bookmarks