About Web Api 2 authentication and authorization

Authentication and authorization

Authentication and authorization, Authentication and Authorize are two different things. Authentication is to confirm the access identity, for example, to verify the user name and password. authorization is to determine whether an operation is permitted after authentication, such as the Authorize attribute. In short, they are authenticated first and then authorized.

The Web Api client can be a browser, GUI application, and various mobile device applications. The designed Api can be used by yourself or by others. Many people get used to IIS. When Web Api is hosted on IIS, they get used to Cookie, but the appearance of Owin Self Host and the appearance of different terminals, cookie becomes a problem and cannot solve the problem.

What should we do? Currently, APIs are provided on various platforms. before third-party applications use data, they perform authentication first and then return the token information. Then, each request sends the token information together, that is, Api requests require verification every time. How can I send the token information without a Cookie?

When using postman to test the Api, you can feel it. Here we will mainly talk about the 2nd methods. We will not talk about the IIS usage, because we can use HttpConext (System. web. dll), so how to implement authentication using the Owin Slef Host method?

 

Web Api authentication implementation

Data Transmission security is not considered here. Prepare for the authentication and provide an Api authentication interface, such as Login. After the authentication is successful, the token (user information and timeout time) is returned ), subsequent Api calls must be authenticated and authorized by the token. There are three implementation methods:

MessageHandler Reference 

This is some way for Web APIs. by inheriting the DelegatingHandler, you can obtain the token information and perform authentication. You only need to configure the implemented MessageHandler as follows:

1 config.MessageHandlers.Add(new BasicAuthenticationHandler());

Attribute Filter Reference

Implement custom Authorize attribute, get token, and then authenticate

Owin MiddlewareReference

When the Web Api is hosted on the Owin Self Host, you can implement your own Middleware for authentication. Besides, Message Handler is only valid for Web APIs, the Middleware can be used for other applications hosted on the Owin, such as SignalR.

Of course, the correct method should be to inherit Microsoft. Owin. Security. AuthenticationMiddleware for implementation. You can refer to other authentication implementations of the Katana Project.

 

Summary

After reading a lot of information, I learned about these implementation methods. In fact, they are all because their knowledge reserves are not enough. First, they mixed up authentication and authorization, and then Asp. net, which hinders the acceptance of new things. In the face of new things, we need to first understand the concepts and principles, and then analyze the processing logic to locate the points of attention to solving the problem. So, we still need to learn more and study in depth.

The implementation of sending user information when HttpClient performs Basic authentication. For more information, see