Hey Guys,
I have a asp.net website and I am accessing that web service from my iPhone app to get data. The WCF web service produces data as JSON.
I want to put some kind of authentication on the WCF. What you you guys recommend?
Thanks
+3
A:
The easiest method would probably be to apply HTTP Basic Authentication to the web service. Passing the credentials from the iPhone shouldn't be too hard.
Chris Pebble
2010-03-25 16:30:42
I am using Rackspace ClousSIte and have no access to IIS how can I get this done in web.config
harekam_taj
2010-03-25 16:34:34
Unfortunately I can't think of any way to setup that kind of authentication without access to IIS. The admin gurus at ServerFault might be able to help you out though.
Chris Pebble
2010-03-25 16:51:55
A:
I have to agree with Chris Pebble, HTTP Basic Authentication will be the easiest.
If you'd like to do something else you could always create an "Authorize" endpoint that will return a token to the user, this token can then be sent along with future requests in order to validate the user. The only benefit I could see to using an "Authorize" endpoint is that you could pass more data back to the user when they authorize (ie: App Settings, theme, real name, etc...).
jessecurry
2010-03-25 16:34:37
It's more robust if the authentication information is passed in with each call. This way, even if the server is restarted in between calls, there's no session lost. On the server side, a session can be cached, but this is transparent to the caller.
Steven Sudit
2010-03-25 16:54:50
I don't particularly like the second method, but I didn't want it to seem as if HTTP basic auth was the only method possible.
jessecurry
2010-03-25 17:20:34
Fair enough. There are also some more serious encryption options available in WCF, but they're not going to work well with a typical client.
Steven Sudit
2010-03-25 19:13:29
There's definitely a lot out there; I've even gone so far as rolling my own key exchange and encrypting data that was already under SSL... but most of that is probably not needed here, and really doesn't do a great deal to protect data once it gets to a device.
jessecurry
2010-03-25 20:22:17