ASP.NET Web API Security Essentials

Table of Contents

ASP.NET Web API Security Essentials

Credits

About the Author

Acknowledgments

About the Reviewer

www.PacktPub.com

Support files, eBooks, discount offers, and more

Why subscribe?

Free access for Packt account holders

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Downloading the example code

Errata

Piracy

Questions

1. Setting up a Browser Client

ASP.NET Web API security architecture

Setting up your browser client

Implementing Web API lookup service

Adding a model

Adding a controller

Consuming the Web API using JavaScript and jQuery

Getting a list of contacts

Getting a contact by ID

Running the application

Authentication and authorization

Authentication

Authorization

Implementing authentication in HTTP message handlers

Setting the principal

Using the [Authorize] attribute

Global authorization filter

Controller level authorization filter

Action level authorization filter

Custom authorization filters

Authorization inside a controller action

Summary

2. Enabling SSL for ASP.NET Web API

Enforcing SSL in a Web API controller

Using client certificates in Web API

Creating an SSL Client Certificate

Configuring IIS to accept client certificates

Verifying Client Certificates in Web API

Summary

3. Integrating ASP.NET Identity System with Web API

Creating an Empty Web API Application

Installing the ASP.NET Identity NuGet packages

Setting up ASP.NET Identity 2.1

ASP.NET Identity

Defining Web API Controllers and methods

Testing the application

Summary

4. Securing Web API Using OAuth2

Hosting OWIN in IIS and adding Web API to the OWIN pipeline

Individual User Account authentication flow

Sending an unauthorized request

Get an access token

Send an authenticated request

Summary

5. Enabling Basic Authentication using Authentication Filter in Web API

Basic authentication with IIS

Basic authentication with custom membership

Basic authentication using an authentication filter

Setting an authentication filter

Action-level authentication filter

Controller-level authentication filter

Global-level authentication filter

Implementing a Web API authentication filter

Setting an error result

Combining authentication filters with host-level authentication

Summary

6. Securing a Web API using Forms and Windows Authentication

Working of Forms authentication

Implementing Forms authentication in Web API

What is Integrated Windows Authentication?

Advantages and disadvantages of using the Integrated Windows Authentication mechanism

Configuring Windows Authentication

Difference between Basic Authentication and Windows authentication

Enabling Windows authentication in Katana

Summary

7. Using External Authentication Services with ASP.NET Web API

Using OWIN external authentication services

Creating an ASP.NET MVC Application

Implementing Facebook authentication

Implementing Twitter authentication

Implementing Google authentication

Implementing Microsoft authentication

Discussing authentication

Summary

8. Avoiding Cross-Site Request Forgery Attacks in Web API

What is a CSRF attack?

Anti-forgery tokens using HTML Form or Razor View

How does an Anti-forgery token work?

Anti-forgery tokens using AJAX

Summary

9. Enabling Cross-Origin Resource Sharing (CORS) in ASP.NET Web API

What is CORS?

How CORS works

Setting the allowed origins

Setting the allowed HTTP methods

Setting the allowed request headers

Setting the allowed response headers

Passing credentials in cross-origin requests

Enabling CORS at various scope

Enable at action level

Enable at controller level

Enable CORS globally

Summary

Index

ASP.NET Web API Security Essentials

ASP.NET Web API Security Essentials

Copyright © 2015 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

First published: November 2015

Production reference: 1241115

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham B3 2PB, UK.

ISBN 978-1-78588-221-0

www.packtpub.com

Credits

Author

Rajesh Gunasundaram

Reviewer

Anuraj Parameswaran

Commissioning Editor

Amarabha Banerjee

Acquisition Editor

Prachi Bisht

Content Development Editor

Anish Dhurat

Technical Editor

Danish Shaikh

Copy Editor

Vibha Shukla

Project Coordinator

Harshal Ved

Proofreader

Safis Editing

Indexer

Mariammal Chettiyar

Production Coordinator

Nilesh Mohite

Cover Work

Nilesh Mohite

About the Author

Rajesh Gunasundaram is a software architect, technical writer and blogger. He has over 13 years of experience in the IT industry, with more than 10 years using Microsoft's .NET and 2 years of using BizTalk Server, and a year of iOS application development.

Rajesh is a founder and an editor of technical blogs: www.programmerguide.net and www.ioscorner.com. You can find many of his technical writings on .NET and iOS.

Rajesh holds a master's degree in computer application and began his career as a software engineer in the year 2002. He has worked on client premises located in various countries, such as the UK, Belarus, and Norway. He is also experienced in developing mobile applications for iPhone and iPad.

His technical strengths include Objective-C, C#, ASP.NET MVC, Web API, WCF, .Net Framework 4.5, AngularJS, BizTalk, SQL Server, REST, SOA, design patterns, and software architecture.

Acknowledgments

I am greatly thankful to my beloved and wonderful friend Ahila Dhayalan, who has constantly encouraged and motivated me while writing this book. She put me back on track whenever I deviated from my schedule of submitting the chapters. Without her support and encouragement, this book wouldn't have been possible.

I am also thankful to the entire team at Packt Publishing for providing me the opportunity to author this book.

Thanks to Prachi Bisht for having confidence in me and giving me the opportunity to write this book.

Thanks to Ajinkya Paranjape for having high regard for me and providing invaluable assistance.

Thanks to Anish Dhurat for guiding and helping me to shape the content of the book.

Thanks to Danish Shaikh for verifying the technical content and bringing it to a good shape.

About the Reviewer

Anuraj Parameswaran works as an architect in Orion India Systems Pvt. Ltd., Kochi. He has extensive experience of more than ten years in working on different technologies, mostly in the Microsoft space. He has been working on the .NET platform since its early days. He leads the technology and innovation team at Orion. He is a cofounder of MobiThoughts, a mobile application development company. His focus areas are data analytics, architecture, and Cloud computing.

He writes about technology in his popular blog at http://www.dotnetthoughts.net/. He is a K-MUG Community Council member and an active volunteer in Microsoft Technology Community.

www.PacktPub.com

Support files, eBooks, discount offers, and more

For support files and downloads related to your book, please visit www.PacktPub.com.

Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at for more details.

At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.

https://www2.packtpub.com/books/subscription/packtlib

Do you need instant solutions to