111 reputation
4
bio website
location
age
visits member for 1 year, 7 months
seen Jun 6 at 0:12

Dec
25
awarded  Popular Question
Jan
21
awarded  Teacher
Dec
13
comment Sharing authentication methods across API and web app
Yep, the application in point 2 is an out-of-the-box implementation, it's the non-browser application (point 3) needing something different.
Dec
13
awarded  Supporter
Dec
13
comment Sharing authentication methods across API and web app
1 - Service layer implemented in ASP.NET WEB API. 2 - Web application uses standard cookies forms authentication, makes AJAX calls to the WEB API service. Easy, out-of-the-box implementation. 3 - Some other non-browser application communicates with the WEB API service, but can't use standard forms authentication cookies. This other application will still username+password authenticate, but it can't use cookies and the login redirect page. So I use a custom http header implementation ontop of forms auth. What confuses me though, is why do I need to do this custom? Isn't it a typical scenario?
Dec
13
comment Sharing authentication methods across API and web app
It was probably misleading to describe it as an API, it's more of a service layer. (For that matter, try getting some clients to understand the difference, ugh.) In a sense, I am mixing authentication methods, since forms authentication doesn't offer a Http headers implementation, only cookies and querystring. I'm using an implementation like MADAM to inject some header-sniffing into the authentication pipeline.
Dec
13
comment Sharing authentication methods across API and web app
Regarding "I'd assume you won't find a framework cause what you want to do is not that hard to solve." - I think you're probably right. But it's such a simple scenario that I'd hoped to find an existing authentication framework that already addressed it. Forms authentication doesn't, but is a good framework for username + password authentication. I've had to hand-bake the solution using an implementation a bit like MADAM. But "hand-baked" and "security" raises alarm bells, hence my question of whether this might introduce "glaring holes".
Dec
13
comment Sharing authentication methods across API and web app
When I say "sharing", I'm talking about both the web application and the API using the same membership, and as much implementation logic as possible (DRY principle). Both entry points using a username + password.
Nov
27
comment Sharing authentication methods across API and web app
Authentication and security protocols are negotiable, it's right there in RFC 2617 - tools.ietf.org/html/rfc2617#section-3.4 - "Security Protocol Negotiation". The "Mixed Authentication Disposition ASP.NET Module" I mentioned in my question also addresses security negotiation scenarios. Granted the security will only be as strong as the weakest link, but that's a known and manageable issue.
Nov
25
comment Sharing authentication methods across API and web app
Thanks for the feedback Alex, though I'm not sure it covers the primary issues of my question. I'm not sure about your assessment that it's the responsibility of the client to deal with the servers service set? Content negotiation is a prime example of services adjusting to the clients request, and this is a major aspect of ASP.NET WEB API. My primary development goal here is authentication, specifically, mixing the front-end techniques (cookies, headers, etc.) available while sharing a common back-end. The question is, do I have to bake my own, or is there something that already does it?
Nov
19
awarded  Student
Nov
19
comment Annotate source code with diagrams as comments
My biggest fear would be abuse of the system. Sure it starts with a diagram meaningful to a complex algorithm, but how long until somebody is uploading flimsy specification documents into the comments for the class? Before you know it, everything project + developer related is blobbed into code comments. Of course, any powerful system is open to abuse. I think the need is a niche, but if you're in that niche it would be a very useful tool.
Nov
19
asked Sharing authentication methods across API and web app