Implementing authentication in ASP.Net Web API

Question

I am aware this is the most basic question and is asked many times, however I have failed to find relevant details for my requirement. I am developing ASP.Net as front end and using ASP.Net Web API service. I am planning to use Basic Auth using SSL.

Could someone help me with below:

1. In future, I plan to have multiple clients including Android, iOS and Windows phone client. Any issues using Basic Auth over SSL?

2. Please help me confirm if below is right implementation approach. I will write new Controller - AccountController in ASP.net Web API and use this controller for methods: Login, Logout and RegisterNewUser. All of them will be POST methods.

3. What should be code inside Login API apart from verifying user from database. Also should login method return any object to client?

4. Any reference which will help me understand client side of code, which will send authorization token on every web api request? Note: I am heavily using jqGrid with CRUD operation, which will make API requests.

Answer 1

There are no problems using Basic Authentication using these clients as far as I know. I have tested this scenario with Android myself.

I have just successfully implemented Basic Auth using this link as a resource: http://www.piotrwalat.net/basic-http-authentication-in-asp-net-web-api-using-message-handlers

/Rune

Answer 2

1) There's no problem using SSL and Basic Auth together.

2/3/4) That would be a valid approach, though I'd recommend that you create a new MVC project and look at the generated code in the AccountController.cs file. This will give you some guidance on how to code these actions.