asp.net mvc 4 web api中的授权

Question

I've been following a series of videos on how to create a web API using MVC 4 . The sixth video describes the authorization process, but it is both too complex for what I want, and it somehow redirects to a form (which makes no sense to me, but then I'm new to this stuff).

I've used API's from other sites, and they usually use one of 2 methods:

1. a token in the url (http://myurl/api/service/?token=[bunch of characters here]

2. a username or password (or token) in the header

I'm leaning towards the second method, as it means I wouldn't have to add a parameter to each of my methods.

If I use this approach, do I need to add code to the beginning of each method to check the headers (request.headers?) for username/password (then find them in our database and see if they have permission to access this method)...Or is there a simpler way of doing this?

Answer 1

You can mark your Controller class with attribute which is derived from AthorizationFilterAttribute. http://msdn.microsoft.com/en-us/library/system.web.http.filters.authorizationfilterattribute(v=vs.108).aspx

In this case you will not need to write authorization checks in every method, but only in one place. This approach is well described under the following link:

http://www.tugberkugurlu.com/archive/api-key-authorization-through-query-string-in-asp-net-web-api-authorizationfilterattribute