官术网_书友最值得收藏!

ASP.NET Web API security architecture

This section will give you an overview of the Web API security architecture and show you all the various extensibility points that can be used for security related things. The ASP.NET Web API security architecture is composed of three main layers. The hosting layer acts as an interface between the Web API and network stacks. The message handler pipeline layer enables implementing cross-cutting concerns such as authentication and caching. The controller handling layer is where the controllers and actions are executed, parameters are bound and validated, and HTTP response message is created. This layer also contains a filter pipeline, as shown in the following figure:

Fig 1 – This image shows the components involved in securing the Web API

Let's briefly discuss the purpose of each components in the Web API pipeline, as follows:

  • Open Web Interface for .NET (OWIN) is the new open standard hosting infrastructure. Microsoft has built its own framework called Katana on top of OWIN and all Web API security techniques such as authentication methods (for example, token-based authentication) and support for social login providers (for example, Google and Facebook) will be happening on the OWIN layer.
  • Message Handler is a class that receives an HTTP request and returns an HTTP response. Implementing authentication at message handler level is not recommended. Message handlers are used for Cross-Origin Resource Sharing (CORS).
  • Authentication Filters are guaranteed to run before the authorization filter. If you are not interested in operating your authentication logic at the OWIN layer, you can straightaway move to controllers or actions. Authentication filters are really useful to invoke OWIN-based authentication logic.
  • Authorization Filters are the places in the pipeline where you can recheck the request before the actual expensive business logic stuff runs in the model binding and validation, and the controller action is invoked.

Now that we are familiar with the security architecture, we will set up the client.

主站蜘蛛池模板: 吕梁市| 九龙城区| 增城市| 团风县| 德格县| 屯留县| 台北县| 泸西县| 昭觉县| 庐江县| 枣强县| 新密市| 民勤县| 新民市| 延川县| 延庆县| 乡宁县| 聂荣县| 嘉善县| 若羌县| 图木舒克市| 潜江市| 九龙城区| 莱芜市| 凤阳县| 宁明县| 眉山市| 衢州市| 辛集市| 乐昌市| 柳林县| 甘德县| 茶陵县| 衢州市| 微博| 澄迈县| 鹤峰县| 平遥县| 甘孜| 文昌市| 扶余县|