RESTful WCF Data Service Authentication

Question

Hi,

I'd like to implement a REST api to an existing ASP.NET MVC website. I've managed to set up WCF Data services so that I can browse my data, but now the question is how to handle authentication.

Right now the data service is secured via the site's built in forms authentication, and that's ok when accessing the service from AJAX forms. However, It's not ideal for a RESTful api.

What I would like as an alternative to forms authentication is for the users to simply embed the user name and password into the url to the web service or as request parameters.

For example, if my web service is usually accessible as

http://localhost:1234/api.svc

I'd like to be able to access it using the url

http://localhost:1234/api.svc/{login}/{password}

So, my questions are as follows:

• Is this a sane approach?

• If yes, how can I implement this? It seems trivial redirecting GET requests so that the login and password are attached as GET parameters. I also know how to inspect the http context and use those parameters to filter the results. But I am not sure if / how the same approach could be applied to POST, PUT and DELETE requests. Can I use GET parameters in POST, PUT and DELETE requests?

Thanks,

Adrian

Edit: The question for me how to embed login and password into the web service's URL so that I can perform POST, PUT and DELETE requests against the web service. I do know how to implement authentication once the web service is running and the login / password are contained somewhere in the HTTPContext. Also, I am not looking for ways to implement forms or basic authentication. I know how to do it, but it is not what I am looking for.

Answer 1

adrian,

i've not had to use restful via authentication but i do have to ensure that groups of users have the rights to access the rest service. this i do via an md5 token that get's passed to the web service (this is a normal json service, not a wcf wrapper). basically, i 'know' which websites are allowed access to my service, so i give them their own api key (which for simplicity is an md5 of the domain name. this get's checked incoming by a filter against the urlreferrer and if the md5 of that matches, then it's go.

I know this isn't the authentication answer, but it's a mid-trust approach that works if you need only a very course level of 'authentication'.

i'd be interest3ed to see how others do do this tho for other projects that i may need a less course grained approach to authentication.

jim

Answer 2

OData - WCF Data Services Best Practices from TechEd - Meta-Me - Site Home - MSDN Blogs

<system.web.extensions>
  <scripting>
    <webServices>
       <authenticationService enabled="true" />
    </webServices>
  </scripting>
</system.web.extensions>

How about this?

Answer 3

See if below answers helps you:

your first question:

•Is this a sane approach?

If your service is running over https, I dont see any probelm to use this method.

•If yes, how can I implement this? It seems trivial redirecting GET requests so that the login and password are attached as GET parameters. I also know how to inspect the http context and use those parameters to filter the results. But I am not sure if / how the same approach could be applied to POST, PUT and DELETE requests. Can I use GET parameters in POST, PUT and DELETE requests?

You can use GET parameters in your other methods eg. Here stream is passed in body.

[OperationContract]
        [WebInvoke(Method="POST", UriTemplate = "UploadFile/{fileName}/{userToken}")]
        string UploadFile(string fileName,string userToken,Stream fileContents);

Answer 4

In the end I used a threefold approach, either of these authentication methods work fine on my data service:

• Basic authentication with the API key as password
• Authentication via an API key embedded as request header
• URL-based authentication with the API key as path to the API. I implemented this with a proxy ASP.NET MVC controller.