Authentication for ASP.Net MVC 4 and WebApi

Question

I would like to set up a system that use both technologies at the same time. My MVC application generates and returns html/css/jaavascript files and then I do some work on the client side that get data through ajax request. Nothing new so far, but I would like also that the ajax endpoing could also be use as a pure REST service .

How can I have a uniform way to authentificate (web forms for MVC clients(that will then use the REST enpoints for the ajax requests) , something else for pure REST clients ).

Thanks

Darin Dimitrov · Accepted Answer · 2012-06-22 09:09:15Z

2

You could use the [Authorize] attribute (the System.Web.Http.AuthorizeAttribute one and not System.Web.Mvc.AuthorizeAttribute) on your Web API controller actions:

public class ValuesController: ApiController
{
    [Authorize]
    public HttpResponseMessage Get()
    {
        string username = User.Identity.Name;
        ...
    }
}

answered Jun 22, 2012 at 9:09

Darin Dimitrov

1.0m275 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Dave Over a year ago

Sounds great, Let me try that. How my REST clients are going to authenticate ? Are they going to send data to the form-auth module?

Darin Dimitrov Over a year ago

The way your REST clients will have to authenticate will depend on what authentication mechanism you have configured. For example if you are usnig Forms Authentication those clients will have to supply a valid Forms Authentication cookie along each request. If you are using AJAX calls this cookie will be automatically sent along each request if the client authenticated initially within the normal MVC application.

Dave Over a year ago

Thanks, I will probably ask my REST clients to do so. Is there any other good pratice to mix the two types of clients?

Dave Over a year ago

The Webapi has two types of clients: AJAX ( clients using their browser) and pure REST clients ( for python/ruby ... ). The former is authenticated when they connect to the website and the latter needs to connect through an api or a scheme.

Darin Dimitrov Over a year ago

OK, I see. The Python/Ruby guys will first have to send an HTTP request to your LogOn action (by providing the username and password) to retrieve the forms authentication cookie and reuse this cookie on subsequent request to the Web API actions.

Collectives™ on Stack Overflow

Authentication for ASP.Net MVC 4 and WebApi

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related