ASP.NET MVC和WebAPI之间的身份验证

Question

I'm currently working on an MVC5 application + WebAPI for some AJAX requests. For the MVC part I use the standard cookie authentication, and token based authentication for the WebAPI part. I'd like the user to log in using only the MVC site, wthout having to authenticate again with the authorization server to obtain an acess token.

Is it safe to get the access token on the server side, put it in a hidden field on the site and use java script to query for it and use it later for the web api requests? Assuming the connection will be over HTTPS, for obvious security reasons :)

Answer 1

您可以将安全性令牌作为api的标头自定义属性传递给api，您可以对其进行预检查并将其缓存为api中的所有后续调用。