How to authenticate user from another localhost?

Question

I'm designing 2 websites (localhost:44300 and localhost:44301). The first to upload images and the second to store the images as an image hosting.

In the Home controller of the second website, I've declared:

[HttpPost]
public ActionResult UploadImages()
{
   //logic...
}

Script in the first website:

$.ajax({
   url: 'https://localhost:44301/Home/UploadImages',
   type: 'POST'
}).done(function (data) {
   //logic...
})

That's great, but: What's happen if there is a request to localhost:44301 which NOT sent by localhost:44300 (another website)?

UploadImages() method still accepts that request and continues uploading.

I think about account. But how can I login from a localhost to another localhost? I cannot put username and password into the ajax. It's easy to read by attacker.

I have 2 questions:

Is it good if I use account in this case? If not, can you give me some tips?

Thank you!

Answer 1

The actual question is dealing with handling server to server authentication between applications not specifically allowing internal access and rejecting external.

Seeing the discussion above between OP and JB King. What I'd truly recommend is that you use Azure Blob Storage or Amazon S3 storage. Then you can easily read or write the binary data between your applications.

The other alternative is just use regular Forms Authentication but you have site1 post the username and password to the login action and get back the auth cookie in the response. You need to just hold onto the auth cookie and pump it into any outbound requests from site1 to site2.

---

Old answer:

If you want to execute authorization on whether the request is local you want to implement a custom AuthorizeAttribute

It would look similar to

public class LocalOnlyAuth : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        if (false == filterContext.RequestContext.HttpContext.Request.IsLocal)
        {
            filterContext.Result = 
               new HttpStatusCodeResult(HttpStatusCode.Forbidden, "Origin is forbidden");
        }
    }
}

and you would apply it

[LocalOnlyAuth]
public class HomeController : Controller