验证网络服务

Question

I have developed some RESTful web services using C#. Can anyone suggest me (with some resources to follow) the best method to authenticate the services since it will be passing through and retrieving some very sensitive data.

Answer 1

Are you using WebAPI for your RESTful services? or have you developed using the deprecated REST starter kit?

If you are using WebAPI, you can follow this link:

http://www.piotrwalat.net/basic-http-authentication-in-asp-net-web-api-using-membership-provider/

You can use Standard Authorize attribute and you can also extend that class to customize to your needs and use https for secure channel.

Answer 2

I will recommend using API Key, here is an post to follow. http://blogs.msdn.com/b/rjacobs/archive/2010/06/14/how-to-do-api-key-verification-for-rest-services-in-net-4.aspx

This gives you the security you need with simplicity, and it doesnt prevent you to add further security on top such as https or use of client certificates.

Answer 3

There's a number of ways to go about this, and your final solution should probably employ a mixture of them. First of all, only expose HTTPS endpoints (and get a good certificate). If possible, use Windows authentication, and limit access to only certain users. You might also encrypt certain of the data elements that are coming in (and decrypt them in your C# code).

Answer 4

In similar situation I am using https and two additional two parameter for each request. Those are user name and encrypted password.

Answer 5

I Knew a simple solution but it's very simple and straight forward,
You can authorize the service request by validating some common input parameter, like some valid key as a query parameter for the service and validate it in the service .. If succeed go ahead, fails say . In JVM Servers I can have the actual key and will request the server to authenticate the incoming key. No aware about C#... HTH

Answer 6

If you are very concerned about authentication, one of the best methods is to use SSL Client Certificates . You create and issue an SSL certificate for each user of your system, and they use that certificate when connecting to your server (obviously, over SSL). You can verify that they are the authenticated user through APIs specific to your web server.