Recommended way to secure ASP.NET 5 Web API application

Question

In previous versions of ASP.NET you got authorization and authentication out of the box from the default template.

I have a Web API application and three or four well defined clients that will consume it and I need to secure it.

I read about OpenID and OAuth but they seem like an overkill for my problem.

What's the simplest way to achieve that?

The default templates will bootstrap you in many different kind of authoriztion/authentification scenarios. docs.asp.net/en/latest/security/authorization/index.html — Maxime Rouiller
– Maxime Rouiller, Commented Dec 17, 2015 at 17:26
The default template comes with Forms Authentication which is fine for regular web applications, but I'm building a Web API for clients with no browser. — Luiso
– Luiso, Commented Dec 17, 2015 at 18:13

Damienbod · Accepted Answer · 2016-01-09 11:46:43Z

1

These would be the 3 best solutions if you require security:

WEB API browser client: Implicit OAuth 2 flow

WEB API Application client: OAuth2 code flow

(With OpenId)

OR: Cookie Authentication with Cross-site request forgery protection. (Default template MVC 6 website template)

If your application is public, I would use at least one of these, otherwise it depends on how secure your data must be.

answered Jan 9, 2016 at 11:46

Damienbod

3422 silver badges8 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

gretro · Accepted Answer · 2016-01-09 15:58:15Z

0

Well, it depends on your scenario. If you don't need authentication (because it's a server-to-server scenario), use a security token as described below. If you need authentication of the user, you may use Basic or Digest security combined with HTTPS.

In a security token scenario, the client simply has to add the token to the request headers and the server needs to validate the token. Make sure the requests transit as HTTPS to make sure the token is encrypted. Remember, this method is only valid if you know the applications that will access your API will be in a secure environment (another server, for example). Otherwise, I would go for another solution.

answered Jan 9, 2016 at 15:58

gretro

2,00916 silver badges26 bronze badges

Collectives™ on Stack Overflow

Recommended way to secure ASP.NET 5 Web API application

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related