Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I am doing a restful web api with asp.net Web API 2

I do not want to use any form of cookies or basic authentication (send user/pass in cleartext thus SSL needed)

I do not use/need claims stuff.

I have not decided yet about asp.net self hosting or IIS.

I just want to send an encrypted token between client server via SSL.

I am using Entity framework 6, .NET 4.5.1 and I just want to do CRUD-actions on my user table.

Not more.

What is the project template/library/approach I should start with to do the above?

share|improve this question
    
Take a look at OAuth 2.0 oauth.net/2 It may seem a little overkill initially but I'm sure you'll find what you are looking for in there. –  Norman Noble Dec 27 '13 at 3:25

1 Answer 1

up vote 3 down vote accepted

Use HMAC with a client ID.

The client uses their "secret" salt to sign the message and then send the server the generated hash along with its ID. The server looks up what the "secret" should be based on the ID the client sent, regenerates the hash with the fetched secret as the salt. If the server-generated hash matches the client-provided hash, then the request is legitimate.

I'm not a ASP/.NET person, so I can't provide any info on libs nor technical approach, but here's some pseudo code:

client

var messageBody = 'POST PLAIN TEXT BODY';
var clientId = '12345';
var secret = 'abcdef';
var digest = createHash(messageBody,secret); // function createHash(string,salt)
var url = 'http://example.org/api?clientId='+clientId+'&hmac='+digest;
sendRequest(url,messageBody); // function sendRequest(url,postbody)

server

var messageBody = 'POST PLAIN TEXT BODY';
var clientId = '12345'; // from GET query
var hmac = '...'; // from GET query
var secret = lookupSecret(clientId);
var digest = createhash(messageBody,secret);
if ( hmac == digest ) {
    // success, handle messageBody
} else {
    // error
}

Consider using a nonce to prevent man-in-the-middle attacks, if that is of concern to you.

share|improve this answer
    
Should not SSL prevent man in the middle attacks?! –  Pascal Dec 27 '13 at 9:07
    
@Pascal Yes SSL will prevent MITM (except for cases outlined in this SO answer: stackoverflow.com/a/14907718/1481489), however I originally misunderstood part of your question and assumed you weren't using SSL since you did not want to send plaintext username/password credentials (which is not the case per the second half of your question). It is worth noting that a nonce is also beneficial in the context of preventing repeat transactions since a nonce can only be used (n)once, although I'd say you shouldn't pragmatically rely on this "feature." –  zamnuts Dec 27 '13 at 10:01
    
Nono I will have to use OR I want to use SSL when I use basic auth everything else would be stupid even for an online edu platform no big secure $$$ cloud service whatever. I think I will go first for basic auth and put later SSL on it. About the the digest/hash stuff I am not sure yet wether I will need/use it. –  Pascal Dec 27 '13 at 20:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.