Web API Token authentication vs Custom token authentication

Question

Very much new to Web API's. Trying to implement the token method the Web API uses to authenticate a user against database and use the token for all successive API calls. But i am finding it very difficult to follow the steps to do the same for mysql DB . I also feel it is a complex process for a simple login.

So my question is instead of using the Web API token method. Why not have a traditional Login function(web api) which checks the userid/pwd against db userid/pwd ? Which generates a token similar to AuthenticationTicket in ApplicationOAuthProvider, and send it as response to an ajax call and store in javascript sessionStorage for successive calls.

What is the difference in terms of security/general in both cases?

PSK · Accepted Answer · 2019-01-20 05:19:37Z

1

There are lot of thing needs to be considered while using a token for authentication. If you are using standard token implemention like JWT, you will get all of these out of the box.

Expiration Handling
Tamper proof (Signed)
Encrypted
Replay Attack protection
Claim based
Decentralized

If you want to go with your custom token implementation, in that case you need to handle all of these on your own which can be time consuming and prone to vulnerability.

answered Jan 20, 2019 at 5:19

PSK

18k5 gold badges35 silver badges44 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

sjd Over a year ago

Any url available on how to setup token for mysql? Is EF mandatory?

Collectives™ on Stack Overflow

Web API Token authentication vs Custom token authentication

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related