Is it possible to expose multiple endpoints using the same WebAPI controller?

Question

I want to create a WebAPI service for use in my single page application but I also want it to be available for a mobile application too.

When users are using the SPA they are signed in using forms authentication and have a session cookie but if they're using the mobile application this wont be the case.

Is it possible to expose the same API controller as 2 different endpoints where one is authenticated using mutual SSL, a token or as a last resort basic auth and the other uses the session cookie?

For example take the following controller:

public class TodoController : 
{
    public IQueryable<TodoModel> GetTodos()
    {
        ...
    }
}

Can I add multiple routes that map to the same method?

https://myapp.example.org/api/todo
https://myapp.example.org/mutual-auth/api/todo

I want to configure IIS to use mutual SSL for the mutual auth endpoint and use forms authentication for the other endpoint.

I've obviously not explained myself well, I'll try again with an edit. — BenCr
– BenCr, Commented Sep 17, 2013 at 14:40

Community · Accepted Answer · 2020-06-20 09:12:55Z

1

Short answer: yes

This is a very broad question, so I won't go into excessive detail about every aspect. I think you should also take a look at BreezeJS because it makes things building these applications significantly easier.

DESIGN

Do you want to build in pure HTML and JavaScript or incorporate CSHTML? The decision is yours, but if you want to eventually create native-based applications using something such as PhoneGap Build, you'll want to stick to pure HTML and JavaScript so that you can compile the code later.

Do you want to use another JS library such as BreezeJS to make life a little easier when designing your controllers? Out of the box, your Web API controllers will be prefixed with api/{controller}/{id} in WebApiConfig. You may want to add {action} routing if you don't go with something like BreezeJS so that you can have more flexibility with your controllers.

Lastly, let's talk about the Repository Pattern and Unit of Work Pattern. This is a bit of hot-topic, but I find that usually creating a repository allows you a great deal of flexibility and it's great for dependency injection. Adding an additional repository layer to your controllers allows you to differentiate between different users or means of access such as a SPA or mobile application very easily. You can use the exact same controllers, but simply draw from different repositories.

SECURITY

You'll want to touch up a bit on [Authorize], [ValidateHttpAntiForgeryTokenAttribute], [Roles("")], and several other data annotations for starters. This is a huge topic which has a ton of reading material online -- invest in some research. Your controller can have multiple actions which have varying limitations on them, such as preventing CSRF on the SPA, but be less restricted on Mobile by either utilizing varying actions on the controller or drawing from separate repositories.

Can I add multiple routes that map to the same method?

https://myapp.example.org/api/todo

https://myapp.example.org/mutual-auth/api/todo

Yes, absolutely. You'll just have to do some extra work with your routing configuration files. With BreezeJS, you get access to not only /api/ but /~breeze/ which works very similarly.

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Sep 17, 2013 at 11:19

Eric Hotinger

9,3965 gold badges39 silver badges44 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Eric Hotinger Over a year ago

As a shameless plug, check out github.com/ehotinger/RequireAdditionalPylons which is an example of some of the technologies I've mentioned in this post and a VERY PRIMITIVE (no security) template which could get you started in the right direction.

BenCr Over a year ago

That's an interesting point about the repository, are you saying inject a repository "factory" and then I can use that to vary the behaviour based on the logged in user?

Eric Hotinger Over a year ago

Yes, you can easily vary it based on the logged in user since you'll have access to the Context's IPrincipal within the repositories. You could even create different filters to switch on different things too, such as cookies, etc.

Fals · Accepted Answer · 2013-09-17 11:21:09Z

0

You can secury your Web API using the way you want. For exemple, you can provide a custom Message Handler or a custom Authorization Filter to provide external authentication via token.

There's a full session from the ASP.NET Team that covers this, you just need to choose which one you will pick up:

Security issues for Web API.

answered Sep 17, 2013 at 11:21

Fals

6,8394 gold badges26 silver badges46 bronze badges

Comments

Badrinarayanan Lakshmiraghavan · Accepted Answer · 2013-09-17 13:23:51Z

Assuming you are hosting web API in IIS, if you enable the forms authentication, FormsAuthenticationModule establishes the identity. That is, if you look at HttpContext.Current.User or Thread.CurrentPrincipal after a successful authentication, the object of type IPrincipal will have the identity (which is FormsIdentity) and the IsAuthenticated property will be set to true. You can do the same thing for any other credential using a custom DelegatingHandler. All you need to do is to validate the credential (token, user id and password in basic scheme in HTTP authorization header or whatever) and set the HttpContext.Current.User and Thread.CurrentPrincipal to an object of type GenericPrincipal with GenericIdentity. After this, the same action method of a controller which is decorated with Authorize will work for both types of requests.

Collectives™ on Stack Overflow

Is it possible to expose multiple endpoints using the same WebAPI controller?

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related