CODEWITHSUNDEEP
asp.net-mvcasp.net-web-api2access-token
Mohan
Mohan

Reputation: 969

How are Web API access tokens validated on the server?

Once a WebAPI access token is generated, how does WebAPI validate that token for the next request? I wonder if I can use an [Authorize] attribute, it must compare the token sent by the client with the token at the server side, if stored somewhere. Does it just check if token is present and not its value?

Upvotes: 11

Views: 22542

Answers (3)

Legends
Legends

Reputation: 22732

Bearer token

First of all, your Identity Provider or Token Provider which issues the authorization tokens needs to have the same machine key settings as the Web Api application for encryption/decryption:

<machineKey decryptionKey="B7EFF1C5839A624ED0268917EDE82F408D2ECBFAC817" validation="SHA1" validationKey="C2B8DF31AB9624D8066DFDA1A479542825F3B48865C4E47AF6A026F22D853DEC2B3248DF268599BF89EF78B9E86CA05AC73577E0D5A14C45E0267588850B" /> </system.web>

Because under the hood Bearertoken uses MachineKey encryption. In other words if you dont have the same settings, your web api won't be able to decrypt the token (validate it). This is done automatically by:

Microsoft.Owin.Security.OAuth.dll

using middleware.

You can use the Authorize Attribute on your web api controllers/actions if you want simple authorization with Usernames or roles like this:

[Authorize(Roles="Administrators,Managers",Users ="Mike,Laura")]

If you want custom authorization, then you have to implement a custom authorization attribute which will handle the custom authorization in your web api. If the user is not allowed to pass you will return a 401 UnAuthorized Response:

actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
actionContext.Response.Headers.Add("WWW-Authenticate","Bearer location='http://localhost:8323/account/login'");

For example:

[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class)]
public class CustomAuthorizeAttribute : System.Web.Http.Filters.AuthorizationFilterAttribute
{
    public RulesExampleEnum[] Rules { get; set; }
    public string Id { get; set; }
    .....
// Summary:
//     Calls when a process requests authorization.
//
// Parameters:
//   actionContext:
//     The action context, which encapsulates information for using System.Web.Http.Filters.AuthorizationFilterAttribute.
public virtual void OnAuthorization(HttpActionContext actionContext);
public virtual Task OnAuthorizationAsync(HttpActionContext actionContext, CancellationToken cancellationToken);

and register it in your webApiConfig.cs

config.Filters.Add(new CustomAuthorizeAttribute());

and apply it on Web Api controller or action:

[CustomAuthorize(Id = "AnyId", Rules = new RulesExampleEnum[] { RulesExampleEnum.Rule1, RulesExampleEnum.Rule3 })]
public IEnumerable<object> Get()
{...

Upvotes: 15

Michael
Michael

Reputation: 1726

Once access token is generated, client must include the access token inside Header for each request.

Client may set the access token inside Authorization HTTP Header.

On the server side, you should create class to handle the Authorization, which is a derived class from System.Web.Http.AuthorizeAttribute, something like below :

public class AuthorizationHandlerAttribute : AuthorizeAttribute
{
    string AccessTokenFromRequest = "";
    if (actionContext.Request.Headers.Authorization != null)
    {
        // get the access token
        AccessTokenFromRequest = actionContext.Request.Headers.Authorization.Parameter;
    }

    string AccessTokenStored = ""; 
    // write some code to get stored access token, probably from database 
    // then assign the value to a variable for later use

    // compare access token
    if (AccessTokenFromRequest != AccessTokenStored)
    {
        // if the token is not valid then return 401 Http Stasus
        // or simply call base method 
        base.HandleUnauthorizedRequest(actionContext);
    }
}

Then you use the newly created class and attach it on controller or action you wished to protect from unauthorized access.

public class UsersController : ApiController
{
    [AuthorizationHandler]
    public User Get(int id)
    {
        // only request with valid access token will reach this 
    }
}

Upvotes: 4

HBomb
HBomb

Reputation: 1117

The secret key is transmitted in the header of the request from the client to the server, and the contents are validated at the server at each request where the [Authorize] attribute is used.

You can use a tool like Fiddler from Telerik (free) to see the data being transported, but not the content (since its encrypted). Inspecting raw web traffic is invaluable when working with MVC / WebAPI, so I highly recommend it. Here's a link to Fiddler, although other similar tools exist as well.

http://www.telerik.com/fiddler

To answer the second part of your question, the server absolutely checks the contents of the secret key before allowing the request to proceed as authorized.

Upvotes: 3

Related Questions