如何使用REST Service-wcf WebHttpBindig对用户进行身份验证？

Question

I have a server-client project written in c#. I want to change the client side to a web client so we can open it with the browser. So I decided to make a WCF rest service that will replace the server side. The binding that I am using for the service is webHttpBinding. My problem is with the behavior of the service. The service data (vars etc..) is initialize after every call. If i add the [ServiceBehavior(InstanceContextMode = InstanceContextMode.PerSession)] it doesn't change anything. If I use [ServiceBehavior(InstanceContextMode = InstanceContextMode.Single)] , it works but I guess that the service instance will be the same for every client.

I have a simple html web page that get a username and password from the client and post it to the service. The service check the Login info with the user database and response. My problem is that i can't save the user status as logged in or not because after every post/get method the service is reset.

what should I do?

Answer 1

This is a pretty standard issue you have to deal with when trying to maintain a session over HTTP, which is what webHttpBinding is using. Even if you try to force it to have a session, it won't. RESTful services don't work that way.

A high level overview of what you have to do is have the service create a token it gives the client upon initial authentication (probably to be stored in a cookie), which the client will then send back with each request. The service can then use that token to check if the client is logged into a particular account with each request. You probably want to make tokens expire after a certain duration (might be 1 month, 1 week, 1 day, 10 minutes, depending on your application).

You can find some more information here:

RESTful Authentication

SPA best practices for authentication and session management

Authentication, Authorization and Session Management in Traditional Web Apps and APIs