How to use ASP.net 5 Identity in web API application? User authentication based on tokens. Mobile apps

Question

Assuming that I currently have a newly created project based on Visual Studio 2015 "WebApp" template with Individual Accounts authentication, I use Microsoft.AspNet.Authentication package and I can't always rely on cookies, because my web API should also target mobile apps:

How can I add authentication to my web API? I'm especially interested in token based authentication.

Answer 1

You can use basic http authentication or implement a similar one with a token or ticket passed through http headers.

Answer 2

Implement custom AuthorizeAttribute in your web api project. In IsAuthorized(HttpActionContext actionContext) overload you can check the authorization scheme and authorization header and then you can connect to your sessions provider and check if the user has an active session. You must pass the login token in the authorization header, so if the token is missing that means there is no active user. So when you login you must create and encrypt the token on successful login. Then pass this token with each request to the server.
This blog contains more information about using AuthorizeAttribute: http://weblogs.asp.net/jongalloway/asp-net-mvc-authentication-customizing-authentication-and-authorization-the-right-way

Answer 3

You can make separate table in db for storing authentication detail (AuthKey, UserID, CreatedDate, ExpiredDate, IsExpired) and make functions like CheckAuthorizationKey(string authKey), ExtendAuthorization(string authKey), ExpireAuthorization(string authKey){}

and call that functions for checking the authorization as below sample code.

public ServiceResult<LoginModel> Login(string auth_key)
 {
            var service = new ServiceResult<LoginModel>();
            LoginModel user = new LoginModel();
            if (AuthKey.CheckAuthorizationKey(auth_key) == false)
            {
                service.message = TemplateCodes.GetMessage(TemplateCodes.UnAuthorize, null, db);
                service.status = ServiceStatus.authorization_failed;
                return service;
            }