官术网_书友最值得收藏!

Authentication and authorization

We have created a simple web API that returns the list of contacts or specific contacts by ID. This web API can be accessed by any client that supports HTTP and is not secured enough. With the help of authentication and authorization mechanisms, we can secure this web API from unauthorized access.

  • Authentication mechanism helps in identifying the valid user and authenticating them using the identity of the user. Here, the identity can be a username and password.
  • Authorization mechanism helps in restricting unauthorized access to an action. For example, An unauthorized user can get the list of contacts. But he is restricted to create new contact.

Authentication

Authentication is carried out in the host Internet Information Service (IIS) for web API. Internet Information Service uses HTTP modules for authentication. We can also implement custom authentication with our own HTTP module.

The host creates a principal when it authenticates the user. Principal is an IPrincipal object that represents the security context under which the code is running. You can access the current principal from Thread.CurrentPrincipal, which is attached by the host. The user information can be accessed from the Identity object of principal. The Identity.IsAuthenticated property returns true if the user is authenticated. The Identity.IsAuthenticated will return false if the user is not authenticated.

Authorization

Authorization happens after successful authentication is provided to the controller. It helps you to grant access to resources when more granular choices are made.

For any unauthorized requests, the authorization filter returns an error response and does not allow the action to be executed. This happens as the authorization filters will be executed first before any statements in the controller action.

主站蜘蛛池模板: 余姚市| 淮南市| 土默特左旗| 通山县| 阿巴嘎旗| 牡丹江市| 吕梁市| 特克斯县| 民乐县| 胶州市| 井研县| 咸宁市| 共和县| 龙游县| 息烽县| 安义县| 贡嘎县| 九龙城区| 琼结县| 云南省| 沅陵县| 阿克陶县| 兴义市| 青岛市| 德兴市| 鄂托克旗| 文安县| 平乐县| 噶尔县| 方正县| 昌吉市| 工布江达县| 双流县| 泾源县| 丹阳市| 突泉县| 广丰县| 洛阳市| 襄樊市| 临沂市| 呼图壁县|