如何为Web API GET请求指定用户名和密码

Question

ASP.NET MVC4 WebAPI application uses forms authentication for WebAPI:

[Authorize]
public class EntityController : APIBase
{
    public HttpResponseMessage Get(string id,
        string _sidx = null,
        string _sord = null,
        uint _page = 1,
        uint _rows = 100,
        string _filters = null,
        int? _dokumnr = null,
        int? _vmnr = null,
        string _isik = null,
        uint _npage = 1,
        bool _unpaid = false,
        uint _layout = 0,
        string _culture = null
    )
    {
 ....

This requires passing authentication cookie. How to allow to call Get() method from browser url.

user name and password can specified in URL using

http:://user:pass@mysite.com/API/Entity/Customer

or as query strings

http:://mysite.com/API/Entity/Customer?user=myuser&password=mypass

How to get user and password in API controller and log on by validation those credentials using form authentication just like Authorize attribute does ?

Or is there better way to invoke this API method from browser url `?

Answer 1

First of all, you should use ViewModels, because your Actions have a lot parameters, and for security reasons you should not pass the username and password via querystring. If you have a scenario more specific, you could create your own [Authorize] filter, and put your validation logic in there. Your authentication information, will hit the server via request Header.