How to design and develop common asp.net identity for both asp.net mvc and asp.net web.api

Question

We are going to start a new solution for both "desktop/mobile responsive web site" and "mobile app". Both projects (web site and mobile app) need to access same business/data layer.

The tier structure for web site is going to be something like the following:

Browser -> ASP.NET MVC Web Site -> Business Layer -> Data Layer -> Database

The tier structure for mobile app is going to be as follows:

Smart Device -> ASP.NET Web Api Service layer -> Business Layer -> Data Layer -> Database

We don't want web site to consume web api.

We also don't need to integrate with any social identity in our scenario. I heard that ASP.NET MVC discourages token approach for security (authentication and authorization) and encourages the cookie approach. However, consuming Web Api will be lot easier, if we employe token approach and cookies are obviously discouraged in REST services.

While we are fine to start with new ASP.NET Identity system, we are not quite sure on how to deal with both scenarios without rewriting and supporting code for both scenarios.

Based on the above grounds, how can we design a common security pattern which works for both of our scenarios ie, ASP.NET MVC Web site and ASP.NET Web API.

Answer 1

If you self-host using OWIN, you can look at creating an OWIN middleware. If you web-host using IIS, you can create an Http module to authenticate and establish the identity by handling authenticate event. Http module can be written in such a way to look for a token and if not present, fall back to cookie. By cookie approach with MVC, I believe you mean Forms Authentication. With that, FormsAuthenticationModule comes into play. So, your module just need to be aware of this and play along nicely. Ultimately, identity is established on Http context and you can use Authorize attribute in both MVC and API controllers. Here is an example of how to create an Http module for authentication. Basic authentication is implemented here but you can modify it for tokens.