Tag Info

New answers tagged

2

There are many reasons not to use basic authentication scheme to protect Web API services. In order to use the service, the client needs to keep the password somewhere in clear text to send it along with each request. The verification of a password should be very slow (to counter brute force attacks), which would hamper scalability of your service. On the ...


2

I'm working on a somewhat-similar system right now, actually; I'd be lying if I said that I knew the "right" way to make this work since I'm still experimenting but maybe going over what I've found to work might help. The setup is pretty heavily inspired by OAuth2 despite its drawbacks, some of which I'll discuss. DISCLAIMER: I'm not a security guy by ...


1

If I'm not mistaken, ASP.NET Web Api handles authentication using the IPrincipal interface. A principal object represents the security context of the user on whose behalf the code is running, including that user's identity (IIdentity) and any roles to which they belong. This object is basically a set of Claims which defines and describes the current ...


1

Ideally authentication should happen neither in the end point nor the service. A module in IIS or a proxy server would be best, or a plugin to the application framework. If you must intermingle the two I would put the authentication in the end point. A "service" object should assume you have permissions to use it so it retains maximum reusability. Really ...



Top 50 recent answers are included