Authentication with Asp.net MVC 6 and Web Api

Question

I'm developing a new project with Asp.Net MVC 6. Each controller will act like a isolated SPA where the Index method will render a view and all operations will be done by Web Api calls. This Web Api will also be used for future mobile apps and also for third party systems.

Is it safe from a integration point of view to use Owin basic authentication over ssl? In older projects I used tokens for the web api project, but in this new one the MVC and Web Api will be mixed and I require an alternative authentication method.

mason · Accepted Answer · 2015-07-27 20:42:30Z

1

Basic authentication's main problem is that the username and password travel in nearly plaintext (it's actually a base64 encoded string, which is easy to recover plaintext from). Meaning that anyone between the client and server can easily retrieve the username and password.

However, if you only allow basic authentication over SSL, then your traffic is encrypted and you can reasonably sure that it's "safe". Assuming it's a good SSL implementation.

edited Jul 27, 2015 at 20:42

answered Jul 27, 2015 at 20:08

mason

32.8k12 gold badges83 silver badges127 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Authentication with Asp.net MVC 6 and Web Api

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related