官术网_书友最值得收藏!

ASP.NET Web API security architecture

This section will give you an overview of the Web API security architecture and show you all the various extensibility points that can be used for security related things. The ASP.NET Web API security architecture is composed of three main layers. The hosting layer acts as an interface between the Web API and network stacks. The message handler pipeline layer enables implementing cross-cutting concerns such as authentication and caching. The controller handling layer is where the controllers and actions are executed, parameters are bound and validated, and HTTP response message is created. This layer also contains a filter pipeline, as shown in the following figure:

Fig 1 – This image shows the components involved in securing the Web API

Let's briefly discuss the purpose of each components in the Web API pipeline, as follows:

  • Open Web Interface for .NET (OWIN) is the new open standard hosting infrastructure. Microsoft has built its own framework called Katana on top of OWIN and all Web API security techniques such as authentication methods (for example, token-based authentication) and support for social login providers (for example, Google and Facebook) will be happening on the OWIN layer.
  • Message Handler is a class that receives an HTTP request and returns an HTTP response. Implementing authentication at message handler level is not recommended. Message handlers are used for Cross-Origin Resource Sharing (CORS).
  • Authentication Filters are guaranteed to run before the authorization filter. If you are not interested in operating your authentication logic at the OWIN layer, you can straightaway move to controllers or actions. Authentication filters are really useful to invoke OWIN-based authentication logic.
  • Authorization Filters are the places in the pipeline where you can recheck the request before the actual expensive business logic stuff runs in the model binding and validation, and the controller action is invoked.

Now that we are familiar with the security architecture, we will set up the client.

主站蜘蛛池模板: 平塘县| 会宁县| 杭锦后旗| 龙口市| 红安县| 武乡县| 莎车县| 常德市| 哈密市| 明星| 溧阳市| 长海县| 务川| 尼勒克县| 旬阳县| 怀安县| 香格里拉县| 沾化县| 丹寨县| 交城县| 务川| 郓城县| 伊通| 蓬安县| 梅河口市| 仲巴县| 文登市| 泰来县| 宁蒗| 兰溪市| 吴堡县| 改则县| 亚东县| 台山市| 类乌齐县| 鸡西市| 马关县| 阿克陶县| 秦皇岛市| 固安县| 都兰县|