User Login Authentication with Restful asp.net Web api and securing API

Question

I am learning to develop asp.net Web API with AngularJS frontend framework. I have been doing a lot of research on this for about a week now.I have read about oauth 2, owin and other. But now confused which is better.

I have a couple of Question and hope you guys can help me with it.

1) In my application - Only Registered User will be able to have access in to application through log-in with email and password. Can someone please point me to a good resource or article on how to create a good registration and log-in authentication with API.Which is secure enough as i will be gathering user data and storing them.

2) What type of security i need to protect my API, at first the API would be behind the firewall and then ones project is finished it will be open to the world? and also please point me to right direction if possible.

Please note this is not a duplicate question i have been through most of the post on stackoverflow and asking this after i could not find answer.

Any suggestion or help on this is appreciated.

Thanks for all your effort on this topic

Answer 1

You can use token based authentication using Asp.Net Web API 2, OWIN, Asp.Net Identity and AngularJS.

Asp.Net Web API now fully supports OWIN. Katana is microsofts OWIN implementation.

Asp.Net Web API now supports authorization using OAuth 2.0. OAuth is made possible with Microsoft OWIN components.

Are yo confused with the terms Identity,OWIN,OAuth ... here is brief overview of them.

Asp.Net Identity is developed to overcome problems by asp.net membership system. Asp.Net Identity allows us to use different storages(Table storage,No SQL) and allows us to use external identity providers as it uses OWIN.

OWIN is to break tight coupling b/w Asp.Net and IIS. OWIN is just a specification. Katana is Microsoft's OWIN implementation. OWIN sits in http request pipeline. OWIN pipeline has middleware components, where we can mention external login mechanisms.

OAuth was created to remove the need for users to share their passwords with third-party applications.

Note: Here Asp.Net Identity has nothing to do with OWIN, OAuth and vice versa. They are three separate concepts. Asp.Net Identity is Microsoft's implementation. OWIN, OAuth are open standard concepts. Because Microsoft has implemented OWIN, OAuth is made possible.

So, Web API 2 uses OAuth bearer token instead of forms authentication cookie, which is more correct in Web API world. Because it allows to use variety of end user devices like mobile devices.

In your case, you can use the default templates provided in visual studio 2013.
1. Create New Project and select Asp.Net web application.
2. Select Web API or SPA template.
3. Change authentication and Select individual user accounts.
4. Click Ok.

Now, everything is configured by default in order to use OWIN, Asp.Net Identity, OAuth. Be cause we use token based authentication, you can find there is no login method available in Account Controller.

1. To register users, use Register method available in AccountController
2. To login, you need to post data in following format to http://example.com/token (Which can be configured in StartUp.Auth.cs)
   grant_type=password&username=Alice&password=password123
3. After login, we recieve bearer token, which we need to send with authorization header with every request to access protected resource.

As you are using awesome frontend framework AngularJs, you can save bearer token in local storage, and you can write a http interceptor service, which takes care of sending bearer token with each request.

Here registering the user is taken care by Asp.Net identity, where as authenticating user is taken care by OAuthAuthorizationServer which is present in Providers folder by default.

Bearer tokens, that we recieve are not towards a specific client,so any one can intercept them. So use them only over SSL.

Please go through this links

http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api http://bitoftech.net/2014/06/09/angularjs-token-authentication-using-asp-net-web-api-2-owin-asp-net-identity/