官术网_书友最值得收藏!

ASP.NET Web API security architecture

This section will give you an overview of the Web API security architecture and show you all the various extensibility points that can be used for security related things. The ASP.NET Web API security architecture is composed of three main layers. The hosting layer acts as an interface between the Web API and network stacks. The message handler pipeline layer enables implementing cross-cutting concerns such as authentication and caching. The controller handling layer is where the controllers and actions are executed, parameters are bound and validated, and HTTP response message is created. This layer also contains a filter pipeline, as shown in the following figure:

Fig 1 – This image shows the components involved in securing the Web API

Let's briefly discuss the purpose of each components in the Web API pipeline, as follows:

  • Open Web Interface for .NET (OWIN) is the new open standard hosting infrastructure. Microsoft has built its own framework called Katana on top of OWIN and all Web API security techniques such as authentication methods (for example, token-based authentication) and support for social login providers (for example, Google and Facebook) will be happening on the OWIN layer.
  • Message Handler is a class that receives an HTTP request and returns an HTTP response. Implementing authentication at message handler level is not recommended. Message handlers are used for Cross-Origin Resource Sharing (CORS).
  • Authentication Filters are guaranteed to run before the authorization filter. If you are not interested in operating your authentication logic at the OWIN layer, you can straightaway move to controllers or actions. Authentication filters are really useful to invoke OWIN-based authentication logic.
  • Authorization Filters are the places in the pipeline where you can recheck the request before the actual expensive business logic stuff runs in the model binding and validation, and the controller action is invoked.

Now that we are familiar with the security architecture, we will set up the client.

主站蜘蛛池模板: 大城县| 尚志市| 大新县| 荥阳市| 金塔县| 永吉县| 高青县| 武平县| 封开县| 社会| 台南市| 池州市| 伊川县| 千阳县| 武陟县| 湘潭市| 讷河市| 会泽县| 金昌市| 拜城县| 平罗县| 阳原县| 惠州市| 聂荣县| 中宁县| 迭部县| 定襄县| 海安县| 丹巴县| 渭南市| 永城市| 西青区| 曲松县| 塔河县| 惠东县| 漳浦县| 黑龙江省| 宜兴市| 濮阳市| 丽江市| 竹北市|