REST WCF Authentication

Question

Hi, I'm building a self-hosting WCF service, which exposes 2 end-points for each service

1. SOAP
2. REST

the SOAP uses WS-* SOAP authentication (authentication header) How can i go about implementing REST authentication?

I thought about some sort of login method which will return a cookie of some sort, but i cant think of how to make this transperent to all of my other calls..

thanks.

Answer 1

One way to go about this is through a Generic that becomes your response wrapper, and a helper function to check the authentication like so:

[DataContract]
public sealed class AuthenticatedRequest<T> {
    [DataMember(Order=0)]
    public string SessionToken {get; set;}

    [DataMember(Order=1)]
    public T RequestBody {get; set; }

    public static bool IsAuthenticated () {
        . . .
    }
}

Answer 2

Requests in a RESTful system are stateless and therefore you are required to re-authenticate on every request.

I suggest you use HTTP Basic Authentication and if that is not sufficient for your scenario then perhaps you can do HTTP Basic Authentication over HTTPS.

Answer 3

Ok, after looking around i've found the answer, i'm passing a special authentication header, similar to Amazon S3.

its not that simple to build but will allow me to work without SSL and will be stateless and support all clients.