Securing ASP.Net Web API with API Key -


i'm developing asp.net mvc 4 web api application application source data different mobile/web client apps. need authenticate user can return correct set of content user. i'm thinking using api key sent every request of web api application. api key identifies user. found post outlines potential solution: from api key user asp.net web api

i need support forms authentication oauth 2.0 facebook, twitter, etc. of these approaches yield token can use send , forth different clients web api can identify user. understand facebook access tokens expire. i'm little confused on what's best way deal facebook interactions. of following paths best way go:

  1. rely on different client apps authenticate against facebook (and other oauth providers) establish facebook access token that's forwarded web api application? means of clients responsible making sure facebook access token not expired. web api app assumes access token valid. seems dangerous me. different apps authenticate user send user information webapi app register user in order user consume data web api app. seems lot of duplication.

  2. make web api application solely responsible interacting facebook (and other oauth providers) on behalf of different client apps using web api. approach seems suggest need build sort of authenticating ui web api app. know asp.net mvc web api can have views , front end stuff, seems me mixing things together. seems web api apps should singularly focused on returning data. users of different client apps register web api app either filling out registration form, or using facebook, twitter, etc. ok mix ui views in pure rest web api application? have start worrying goes uis on different devices, etc.

  3. is there way i'm not seeing?

i appreciate guidance , links examples might have. time.

i suggest below approach:
1. create authentication api authenticate user. if user authenticated successfully, create session (self implemented, may record in db) user.
2. next time user call other apis returns content user. in case must user provider session id (which have created in first step) content. if sessionid provided user not exist @ end, means user not authenticated. in case can return authentication error message user telling needs authenticated first. flexible, scaleable solution in way can store many information regarding user session. once authenticated, user not need authenticated every time calls other apis content. save authenticating user every time.


Comments

Post a Comment

Popular posts from this blog

html - How to style widget with post count different than without post count -

i have border below li elements in wordpress widget types appropriate. element inside set block gives them nice easy click full width. the problem, when choose option "show post count" when adding widget such categories or archives displays post count plain text after tag , because tag block pushes post number text line below. whether choose show post count or not show post count still gives exact same element identifyer example "widget_categories". how style post count not on next line still keep links non post count list items full width? here's example on sidebar www.bbmthemes.com/themes/modular/blog-standard/ in order solve problem need remove display:block; for ul.widgets ul a , add in it's place line-height: 33px; what going achieve have same visual effect. what going lose doing links going work on text , not on "box". the other way out of find post count coming , make changes this. example change text count i
Read more

How to remove text and logo OR add Overflow on Android ActionBar using AppCompat on API 8? -

have researched death , cannot find answer. i have actionbar using appcompat. supporting api v7 (api v8 do). actionbar works api v11. api < v11 has problem of removing icon (and feature) actionbar without supplying overflow. big picture have app logo, app title, , 3 icons squidging same actionbar on low end phone. trying make room! i happy 1 of 2 solutions. either: a method of getting overflow functionality can retrieved pull down. (preferred) method of removing icon , text actionbar below current xml api 11+: <resources> <!-- base application theme api 11+. theme replaces appbasetheme res/values/styles.xml on api 11+ devices. --> <style name="appbasetheme" parent="theme.appcompat.light.darkactionbar"> <item name="android:actionbarstyle">@style/liteactionbarstyle</item> <item name="actionbarstyle">@style/liteactionbarstyle</item> </st
Read more

javascript - storing input from prompt in array and displaying the array -

i want take the inputs user prompt, store input in array, , display it. want take 10 inputs user using for loop. have tried do-while shown below. var givennames = new array(); var pattern = /[\w\d]{1,}/ig; do{ var name = prompt("enter names. letters , digits accepted!\nentering empty field stops asking",""); if(name && name.match(pattern)){givennames.push(name);} } while(name != ""); function displaynames(){ if(givennames.length > 0){ document.getelementbyid("list").innerhtml = "<span style='color:navy;font- weight:bold;'>given names are:<\/span><br><br>" + givennames.join("<br><br>"); } else { document.getelementbyid("list").innerhtml = "<span style='color:navy;font-weight:bold;'>nothing has been given!<\/span>"; } } how replace for loop? var givennames = new array();
Read more