如何在Web API应用程序中使用ASP.net 5 Identity？ 基于令牌的用户身份验证。 移动应用

Question

Assuming that I currently have a newly created project based on Visual Studio 2015 "WebApp" template with Individual Accounts authentication, I use Microsoft.AspNet.Authentication package and I can't always rely on cookies, because my web API should also target mobile apps:

How can I add authentication to my web API? I'm especially interested in token based authentication.

Answer 1

您可以使用基本的http身份验证或使用通过http标头传递的令牌或票证实现类似的身份验证。

Answer 2

Implement custom AuthorizeAttribute in your web api project. In IsAuthorized(HttpActionContext actionContext) overload you can check the authorization scheme and authorization header and then you can connect to your sessions provider and check if the user has an active session. You must pass the login token in the authorization header, so if the token is missing that means there is no active user. So when you login you must create and encrypt the token on successful login. Then pass this token with each request to the server.
This blog contains more information about using AuthorizeAttribute: http://weblogs.asp.net/jongalloway/asp-net-mvc-authentication-customizing-authentication-and-authorization-the-right-way

Answer 3

You can make separate table in db for storing authentication detail (AuthKey, UserID, CreatedDate, ExpiredDate, IsExpired) and make functions like CheckAuthorizationKey(string authKey), ExtendAuthorization(string authKey), ExpireAuthorization(string authKey){}

and call that functions for checking the authorization as below sample code.

public ServiceResult<LoginModel> Login(string auth_key)
 {
            var service = new ServiceResult<LoginModel>();
            LoginModel user = new LoginModel();
            if (AuthKey.CheckAuthorizationKey(auth_key) == false)
            {
                service.message = TemplateCodes.GetMessage(TemplateCodes.UnAuthorize, null, db);
                service.status = ServiceStatus.authorization_failed;
                return service;
            }