What Uniquely Identifies a Client Making a Request to Web API?

Question

Let's say I write a piece of code that makes an http call to a web api, something like:

$http.get('www.myapi.com/api/controller/endpoint').then(function(resp){...})

I then give this code to two people that live in different cities and they hit my API from their respective houses (just from some browser). What information can my API get out of the http request that will allow me to tell apart person A and person B calling it? Is the IP always available? Is the MAC address ever available? What else is there?

How can person A pretend to be person B when calling my API?

Furthermore, what if person C calls my Web API from their own Web API (backend)? Will the same information be available, or what will be different?

This is a general question, but if you want to get specific, let's assume ASP.NET Web API 2 is receiving the http requests.

Answer 1

You're describing a desire for pre-authentication.

The IP will always be available. You could restrict the service to only those IP ranges. It's not a good way to do authentication.

Trying to get around having to perform authentication is not safe. You should use a proper authentication method. Combining IP restrictions with other methods is fine.

John Meyer's answer is essentially pre-shared token based user authentication. Having a valid token constitutes being constantly logged in. The token can be compromised far more easily than a typical token based user authentication that establishes a temporary token with a limited lifetime.

If you decide to go the pre-shared token route, please use a method that supports proper rotation or permutation of the token over time, such that it isn't vulnerable to replay attacks.

Your best option for this scenario is typical session-token based user authentication.

If you're actually not interested in who is using your service, only that they be uniquely identified, you can safely establish a session (or permanent, or arbitrary lifetime) cookie per user by the http Set-Cookie header that all clients should automatically respect and support, then use that as your method of tracking.

Answer 2

My team has accomplished this by requiring that an identification header be included on all requests. This does require some customization on the part of the calling party, but does not necessarily require that the user be logged in. Of course, the value of the header could be change by malicious users so if these calls need to be very secure you will need traditional authentication.