Web API验证用户并检查是否有权访问资源

Question

I need an advise. I'm building a Web API for my app and I need to auth users who use it. The user will have access to his data, but may have access to others users data as well. In my database I manage the users and what other users they have access to (you might think of it like in Facebook where a user has access to his profile and his friends profiles, but not to other people profiles).

In my app, the user enters a username and password, and those are saved encrypted on the devise. They are later sent (via SSL) to the API on each call - what I've done is implement a Basic Authentication. If there is a better "best practice" to work please feel free to suggest - I'm new to this.

So far it works - but the problem is that working like this

1. the user once authenticated also has access to other profiles - what I would like to do is have him only get the profile ( http://myaddress.com/Users/ {id}) that belongs to him and the items that he owns ( http://myaddress.com/Users/ {id}/items) - and not for profiles and items by other users.
2. If the user is trying to access a profile or items of another user that he is connected to - allow that access.

What I thought about is passing the requested URI to my login method, and then check what user / resource the user is trying to access and than check the database - but that seems like a lot of work and a lot of IF statements.

So before I start writing, I thought I'd ask to see if there's a better way to do this. I have the HttpActionContext, I just don't know how to use it to my advantage.

Hope I was clear about my question. If not, feel free to ask for clarifications.

Answer 1

So you identify the user from his/her credentials that are sent on every API request. Could be switched some token based flow, that user authenticates just once and gets token(acts like user credentials) which is then sent to back-end API on every resource request. Then you can control the token, revoke access etc. What you could is make some kind of permission service, that all resources/objects have permissions attached to it and then just assign needed persmission to users read/write to this object maybe. Might be a massive task to implement. My opinions.