Api authentication options with asp.net mvc

Question

I'm looking to restrict access to controllers/actions that represent my website's api. Only registered users who meet a certain criteria (pay accounts, not free trials) will be able to use the api. The website currently supports forms authentication with users logging in with a username/password combination or via open id.

How would have the users authenticate with the api? The api will initially be used by mobile applications (iphone, droid). My main concern is open id support with mobile apps.

My thoughts on available options are:

Support both Username/password & open id - Not sure how well iphone/droid apps can support openid authentication.
Only support Username/password - force OpenId users to create un/pwd for api - Bad UX for OpenId users
Use an api token - This worries me for two reasons:
1. Users would have to manually type in their api key which sucks from a UX point of view
2. They could easily distribute/share their api key with other users and that would ruin reports/metrics.
Something else that I missed?

Beep beep · Accepted Answer · 2009-12-16 05:51:49Z

0

We use #1 - open id or username/password. I don't see how this is specific to asp.net or asp.net mvc though ... it seems like more of an architectural question.

answered Dec 16, 2009 at 5:51

Beep beep

19.2k12 gold badges68 silver badges78 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Jim Geurts Over a year ago

So iphone and droid apps have no problems authenticating to webservices using openid?

Community · Accepted Answer · 2017-05-23 12:01:12Z

0

I think it depends on how your creating your services API (REST/JSON, XML, WCF, etc..) but here are some links that will help:

ASP.NET MVC - HTTP Authentication Prompt

http://code.google.com/p/dotnetopenid/

edited May 23, 2017 at 12:01

CommunityBot

11 silver badge

answered Dec 16, 2009 at 15:21

Carol Skelly

364k92 gold badges741 silver badges651 bronze badges

Comments

Jim Geurts · Accepted Answer · 2012-10-16 19:37:53Z

-1

I found that token based authentication worked the best.

OAuth 2 is an attractive alternative that would be supported by all mobile devices and a site that already allows multiple forms of authentication.

DotNetOpenAuth offers a .net library for working with OAuth2, among other authentication technologies.

edited Oct 16, 2012 at 19:37

answered Jan 22, 2012 at 22:20

Jim Geurts

20.5k24 gold badges100 silver badges119 bronze badges

1 Comment

Levitikon Over a year ago

Link provided doesn't offer implementation for .net, as the OP asked.

Collectives™ on Stack Overflow

Api authentication options with asp.net mvc

3 Answers 3

1 Comment

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related