ASP.NET MVC 3 Restrict API Access

Question

I have an ASP.NET MVC 3 application with a self hosted ServiceStack API that provides the data. After I added the API location path in Web.Config the API is callable by my code and works well:

<location path="api">
    <system.web>
        <authorization>
            <allow users="*"/>
        </authorization>
    </system.web>
</location>

The problem I have is that when the application is running the API is accessible via the browser - I can simply type http:\localhost:xxxx\api into the browser. What would be a good approach to restricting access to my self hosted API so that I can continue to call it within the MVC 3 application but prevent users from accessing the API via the browser?

Note that at some point in the future I will want to expose some areas of the API to make them publicly accessible.

mythz · Accepted Answer · 2012-05-10 16:32:17Z

Note: the Authorization and Authentication support built-into ServiceStack is independent and decoupled from ASP.NET's Authentication.

You can generically restrict access to all your services by inheriting from a base class which contains one or more of:

[Authenticate] - Only allow access to Authenticated users
[RequiredRole] - Only allow access to users in the specified roles
[RequiredPermission] - Only allow access to users with the specified permissions

Note: These attributes also work in your MVC Controllers that inherit from ServiceStackController or Controllers marked with the [ExecuteServiceStackFilters] attribute.

You can inspect a MVC + ServiceStack demo that uses these attributes in the Social Bootstrap Api example project.

Another way you can generically restrict access is by registering a global Request filter which get executed on every request.

Darin Dimitrov · Accepted Answer · 2012-05-10 11:47:31Z

One possibility is to use a specific user for accessing the API:

<location path="api">
    <system.web>
        <authorization>
            <allow users="api_user" />
        </authorization>
    </system.web>
</location>

Then configure your API to be accessible only by the api_user. This way any other authenticated user in the browser won't be able to access this API. In your ASP.NET MVC 3 application you could create an authentication ticket with the given user before sending an HTTP request to the API.

Also notice that using the <location> tag in web.config to control authorization in ASP.NET MVC application is a very bad idea. The reason for this is that you are relying on some url (api). But ASP.NET MVC works with routes. So you should be using the [Authorize] or a custom authorization attribute to decorate the corresponding controllers/actions that you want to protect. This way your authorization is no longer dependent on your routing configuration.

Another possibility is to use a custom authoriza attribute and implement an access token.

Collectives™ on Stack Overflow

ASP.NET MVC 3 Restrict API Access

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related