RESTful Day #5 - Security in Web API - Basic & Token Based Custom Authorization in Web APIs Using Action Filters

namespace BusinessServices
{
    public interface IUserServices
    {
        int Authenticate(string userName, string word);
    }
}

using DataModel.UnitOfWork;

namespace BusinessServices
{
    /// <summary>
    /// Offers services for user specific operations
    /// </summary>
    public class UserServices : IUserServices
    {
        private readonly UnitOfWork _unitOfWork;

        /// <summary>
        /// Public constructor.
        /// </summary>
        public UserServices(UnitOfWork unitOfWork)
        {
            _unitOfWork = unitOfWork;
        }

        /// <summary>
        /// Public method to authenticate user by user name and word.
        /// </summary>
        /// <param name="userName"></param>
        /// <param name="word"></param>
        /// <returns></returns>
        public int Authenticate(string userName, string word)
        {
            var user = _unitOfWork.UserRepository.Get(u => u.UserName == userName && u.word == word);
            if (user != null && user.UserId > 0)
            {
                return user.UserId;
            }
            return 0;
        }
    }
}

registerComponent.RegisterType<IUserServices, UserServices>();

using System.ComponentModel.Composition;
using DataModel;
using DataModel.UnitOfWork;
using Resolver;

namespace BusinessServices
{
    [Export(typeof(IComponent))]
    public class DependencyResolver : IComponent
    {
        public void SetUp(IRegisterComponent registerComponent)
        {
            registerComponent.RegisterType<IProductServices, ProductServices>();
            registerComponent.RegisterType<IUserServices, UserServices>();
        }
    }
}

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false)]
public class GenericAuthenticationFilter : AuthorizationFilterAttribute
{
    /// <summary>
    /// Public default Constructor
    /// </summary>
    public GenericAuthenticationFilter() { }

    private readonly bool _isActive = true;

    /// <summary>
    /// parameter isActive explicitly enables/disables this filter.
    /// </summary>
    /// <param name="isActive"></param>
    public GenericAuthenticationFilter(bool isActive)
    {
        _isActive = isActive;
    }

    /// <summary>
    /// Checks basic authentication request
    /// </summary>
    /// <param name="filterContext"></param>
    public override void OnAuthorization(HttpActionContext filterContext)
    {
        if (!_isActive) return;
        var identity = FetchAuthHeader(filterContext);
        if (identity == null)
        {
            ChallengeAuthRequest(filterContext);
            return;
        }
        var genericPrincipal = new GenericPrincipal(identity, null);
        Thread.CurrentPrincipal = genericPrincipal;
        if (!OnAuthorizeUser(identity.Name, identity.word, filterContext))
        {
            ChallengeAuthRequest(filterContext);
            return;
        }
        base.OnAuthorization(filterContext);
    }

    /// <summary>
    /// Virtual method.Can be overriden with the custom Authorization.
    /// </summary>
    /// <param name="user"></param>
    /// <param name=""></param>
    /// <param name="filterContext"></param>
    /// <returns></returns>
    protected virtual bool OnAuthorizeUser(string user, string , HttpActionContext filterContext)
    {
        if (string.IsNullOrEmpty(user) || string.IsNullOrEmpty("")) return false;
        return true;
    }

    /// <summary>
    /// Checks for autrhorization header in the request and parses it, creates user credentials and returns as BasicAuthenticationIdentity
    /// </summary>
    /// <param name="filterContext"></param>
    protected virtual BasicAuthenticationIdentity FetchAuthHeader(HttpActionContext filterContext)
    {
        string authHeaderValue = null;
        var authRequest = filterContext.Request.Headers.Authorization;
        if (authRequest != null && !String.IsNullOrEmpty(authRequest.Scheme) && authRequest.Scheme == "Basic") authHeaderValue = authRequest.Parameter;
        if (string.IsNullOrEmpty(authHeaderValue)) return null;
        authHeaderValue = Encoding.Default.GetString(Convert.FromBase64String(authHeaderValue));
        var credentials = authHeaderValue.Split(':');
        return credentials.Length < 2 ? null : new BasicAuthenticationIdentity(credentials[0], credentials[1]);
    }


    /// <summary>
    /// Send the Authentication Challenge request
    /// </summary>
    /// <param name="filterContext"></param>
    private static void ChallengeAuthRequest(HttpActionContext filterContext)
    {
        var dnsHost = filterContext.Request.RequestUri.DnsSafeHost;
        filterContext.Response = filterContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
        filterContext.Response.Headers.Add("WWW-Authenticate", string.Format("Basic realm=\"{0}\"", dnsHost));
    }
}

protected virtual BasicAuthenticationIdentity FetchAuthHeader(HttpActionContext filterContext)
{
    string authHeaderValue = null;
    var authRequest = filterContext.Request.Headers.Authorization;
    if (authRequest != null && !String.IsNullOrEmpty(authRequest.Scheme) && authRequest.Scheme == "Basic") 
        authHeaderValue = authRequest.Parameter;
    if (string.IsNullOrEmpty(authHeaderValue)) 
        return null;
    authHeaderValue = Encoding.Default.GetString(Convert.FromBase64String(authHeaderValue));
    var credentials = authHeaderValue.Split(':');
    return credentials.Length < 2 ? null : new BasicAuthenticationIdentity(credentials[0], credentials[1]);
}

var genericPrincipal = new GenericPrincipal(identity, null);
Thread.CurrentPrincipal = genericPrincipal;
if (!OnAuthorizeUser(identity.Name, identity.word, filterContext))
{
    ChallengeAuthRequest(filterContext);
    return;
}
base.OnAuthorization(filterContext);

filterContext.Response.Headers.Add("WWW-Authenticate", string.Format("Basic realm=\"{0}\"", dnsHost));

public GenericAuthenticationFilter(bool isActive)
{
    _isActive = isActive;
}

using System.Security.Principal;

namespace WebAPI.Filters
{
    /// <summary>
    /// Basic Authentication identity
    /// </summary>
    public class BasicAuthenticationIdentity : GenericIdentity
    {
        /// <summary>
        /// Get/Set for word
        /// </summary>
        public string word
        {
            get;
            set;
        }
        /// <summary>
        /// Get/Set for UserName
        /// </summary>
        public string UserName
        {
            get;
            set;
        }
        /// <summary>
        /// Get/Set for UserId
        /// </summary>
        public int UserId
        {
            get;
            set;
        }

        /// <summary>
        /// Basic Authentication Identity Constructor
        /// </summary>
        /// <param name="userName"></param>
        /// <param name="word"></param>
        public BasicAuthenticationIdentity(string userName, string word) : base(userName, "Basic")
        {
            word = word;
            UserName = userName;
        }
    }
}

protected override bool OnAuthorizeUser(string username, string word, HttpActionContext actionContext)
{
    var provider = actionContext.ControllerContext.Configuration.DependencyResolver.GetService(typeof(IUserServices)) as IUserServices;
    if (provider != null)
    {
        var userId = provider.Authenticate(username, word);
        if (userId > 0)
        {
            var basicAuthenticationIdentity = Thread.CurrentPrincipal.Identity as BasicAuthenticationIdentity;
            if (basicAuthenticationIdentity != null) basicAuthenticationIdentity.UserId = userId;
            return true;
        }
    }
    return false;
}

using System.Threading;
using System.Web.Http.Controllers;
using BusinessServices;

namespace WebAPI.Filters
{
    /// <summary>
    /// Custom Authentication Filter Extending basic Authentication
    /// </summary>
    public class APIAuthenticationFilter : GenericAuthenticationFilter
    {
        /// <summary>
        /// Default Authentication Constructor
        /// </summary>
        public APIAuthenticationFilter() { }

        /// <summary>
        /// AuthenticationFilter constructor with isActive parameter
        /// </summary>
        /// <param name="isActive"></param>
        public APIAuthenticationFilter(bool isActive) : base(isActive) { }

        /// <summary>
        /// Protected overriden method for authorizing user
        /// </summary>
        /// <param name="username"></param>
        /// <param name="word"></param>
        /// <param name="actionContext"></param>
        /// <returns></returns>
        protected override bool OnAuthorizeUser(string username, string word, HttpActionContext actionContext)
        {
            var provider = actionContext.ControllerContext.Configuration.DependencyResolver.GetService(typeof(IUserServices)) as IUserServices;
            if (provider != null)
            {
                var userId = provider.Authenticate(username, word);
                if (userId > 0)
                {
                    var basicAuthenticationIdentity = Thread.CurrentPrincipal.Identity as BasicAuthenticationIdentity;
                    if (basicAuthenticationIdentity != null) basicAuthenticationIdentity.UserId = userId;
                    return true;
                }
            }
            return false;
        }
    }
}

public class ProductController : APIController 
{
    #region Private variable.   
    private readonly IProductServices _productServices;  
    #endregion
    #region Public Constructor
    
    /// <summary>
    /// Public constructor to initialize product service instance
    /// </summary>
    public ProductController(IProductServices productServices) 
    {
        _productServices = productServices;
    }
    
    #endregion
    
    // GET API/product
    [GET("allproducts")]
    [GET("all")]
    public HttpResponseMessage Get() 
    {
        var products = _productServices.GetAllProducts();
        var productEntities = products as List<ProductEntity>? ?? products.ToList();
        if (productEntities.Any()) 
            return Request.CreateResponse(HttpStatusCode.OK, productEntities);
        return Request.CreateErrorResponse(HttpStatusCode.NotFound, "Products not found");
    }
    
    // GET API/product/5
    [GET("productid/{id?}")]
    [GET("particularproduct/{id?}")]
    [GET("myproduct/{id:range(1, 3)}")]
    public HttpResponseMessage Get(int id) 
    {
        var product = _productServices.GetProductById(id);
        if (product != null) 
            return Request.CreateResponse(HttpStatusCode.OK, product);
        return Request.CreateErrorResponse(HttpStatusCode.NotFound, "No product found for this id");
    }
    
    // POST API/product
    [POST("Create")]
    [POST("Register")]
    public int Post([FromBody] ProductEntity productEntity) 
    {
        return _productServices.CreateProduct(productEntity);
    }
    
    // PUT API/product/5
    [PUT("Update/productid/{id}")]
    [PUT("Modify/productid/{id}")]
    public bool Put(int id, [FromBody] ProductEntity productEntity) 
    {
        if (id > 0) 
        {
            return _productServices.UpdateProduct(id, productEntity);
        }
        return false;
    }
    
    // DELETE API/product/5
    [DELETE("remove/productid/{id}")]
    [DELETE("clear/productid/{id}")]
    [PUT("delete/productid/{id}")]
    public bool Delete(int id) 
    {
        if (id > 0) 
            return _productServices.DeleteProduct(id);
        return false;
    }
}

[APIAuthenticationFilter]
[RoutePrefix("v1/Products/Product")]
public class ProductController : APIController

GlobalConfiguration.Configuration.Filters.Add(new APIAuthenticationFilter());

// GET API/product
[APIAuthenticationFilter(true)]
[GET("allproducts")]
[GET("all")]
public HttpResponseMessage Get()
{
    // Code logic here
}

// GET API/product/5
[APIAuthenticationFilter(false)]
[GET("productid/{id?}")]
[GET("particularproduct/{id?}")]
[GET("myproduct/{id:range(1, 3)}")]
public HttpResponseMessage Get(int id)
{
    // Code logic here
}

We already have our test client added, but for new readers, just go to Manage Nuget Packages, by right-clicking WebAPI project and type WebAPITestClient into the search box in online packages as in the following.

You'll get “A simple Test Client for ASP.NET Web API”, just add it. You'll get a help controller in Areas -> HelpPage as shown below.

I have already provided the database scripts and data in my previous article, you can use that.

Append “/help” to the application URL and you'll get the test client.

GET

POST

PUT

DELETE

You can test each service by clicking on it. Once you click on the service link, you'll be redirected to test the service page of that specific service. On that page there is a button Test API in the right bottom corner, just press that button to test your service.

Service to Get All the products.

When you click on the Send request, a dialog will be shown asking for Authentication. Just cancel that dialog and let the request go without credentials. You'll get a response of Unauthorized, in other words, 401.

This means our authentication mechanism is working.

Just to double check it, let's send the request with credentials now. Just add a header too with the request. The header should be like:

Authorization: Basic YWtoaWw6YWtoaWw=

Here “YWtoaWw6YWtoaWw=” is my Base64 encoded user name and word, in other words Akhil: Akhil.

Click on Send and we get the response as desired.

Likewise, you can test all the service endpoints.

This means our service is working with Basic Authentication.

Design discrepancy

This design, when running on SSL, is very good for implementing Basic Authentication. But there are a few scenarios in which, along with Basic Authentication, I would like to leverage authorization too and not even authorization but sessions too. When we talk about creating an enterprise application, it just does not limit things to securing our endpoints with authentication only.

In this design, I'll need to send a user name and word each time with every request. Assume I want to create an application where authentication only occurs only once as my login is done and after successfully authentication, in other words logging in, I must be able to use other services of that application. In other words, I am then authorized to use those services. Our application should be robust enough that it restricts even authenticated users from using other services he is not authorized for. Yes, I am talking about Token-based authorization.

I'll expose only one endpoint for authentication and that will be my login service. So the client only knows about that login service that needs credentials to get logged into the system.

After the client successfully logs in I'll send a token that could be a GUID or an encrypted key by any XYZ algorithm that I want when the user makes a request for any other services after login, should provide this token along with that request. And to maintain sessions, our token will have an expiry too, which will last for 15 minutes, and can be made configurable using the web. config file. After the session expires, the user will be logged out and will again need to use the login service with credentials to get a new token. Seems exciting to me, let's implement this.

Implementing Token-based Authorization

To overcome the preceding scenarios, let's start developing and giving our application the shape of a thick client enterprise architecture.

Set Database

Let's start with setting up a database. When we see the previously created database that we had set up in the first part of the series, we have a token table. We require this token table for token persistence. Our token will persist in the database with an expiry time. If you are using your own database, you can create a token table as in the following:

Set Business Services

Just navigate to BusinessServices and create one more Interface named ITokenServices for the token-based operations as in the following.

using BusinessEntities;
namespace BusinessServices
{
    public interface ITokenServices
    {
        #region Interface member methods

        /// <summary>
        /// Function to generate unique token with expiry against the provided userId.
        /// Also add a record in database for generated token.
        /// </summary>
        /// <param name="userId"></param>
        /// <returns></returns>
        TokenEntity GenerateToken(int userId);

        /// <summary>
        /// Function to validate token againt expiry and existance in database.
        /// </summary>
        /// <param name="tokenId"></param>
        /// <returns></returns>
        bool ValidateToken(string tokenId);

        /// <summary>
        /// Method to kill the provided token id.
        /// </summary>
        /// <param name="tokenId"></param>
        bool Kill(string tokenId);

        /// <summary>
        /// Delete tokens for the specific deleted user
        /// </summary>
        /// <param name="userId"></param>
        /// <returns></returns>
        bool DeleteByUserId(int userId);

        #endregion
    }
}

We have four methods defined in this interface. Let's create a TokenServices class that implements ITokenServices and understands each method.

The GenerateToken method takes a userId as a parameter and generates a token, encapsulates that token in a token entity with a Token expiry time, and returns it to the caller.

public TokenEntity GenerateToken(int userId)
{
    string token = Guid.NewGuid().ToString();
    DateTime issuedOn = DateTime.Now;
    DateTime expiredOn = DateTime.Now.AddSeconds(
        Convert.ToDouble(ConfigurationManager.AppSettings["AuthTokenExpiry"]));
    var tokendomain = new Token {
        UserId = userId,
        AuthToken = token,
        IssuedOn = issuedOn,
        ExpiresOn = expiredOn
    };
   
    _unitOfWork.TokenRepository.Insert(tokendomain);
    _unitOfWork.Save();
    var tokenModel = new TokenEntity() {
        UserId = userId,
        IssuedOn = issuedOn,
        ExpiresOn = expiredOn,
        AuthToken = token
    };
   
    return tokenModel;
}

When generating a token, it names a database entry into the Token table.

The ValidateToken method just validates whether the token associated with the request is valid or not, in other words, it exists in the database within its expiry time limit.

public bool ValidateToken(string tokenId)
{
    var token = _unitOfWork.TokenRepository.Get(t => t.AuthToken == tokenId && t.ExpiresOn > DateTime.Now);
    if (token != null && !(DateTime.Now > token.ExpiresOn))
    {
        token.ExpiresOn = token.ExpiresOn.AddSeconds(
            Convert.ToDouble(ConfigurationManager.AppSettings["AuthTokenExpiry"]));
        _unitOfWork.TokenRepository.Update(token);
        _unitOfWork.Save();
        return true;
    }
    return false;
}

It just takes the token ID supplied in the request.

Kill Token just kills the token, in other words, removes the token from the database.

public bool Kill(string tokenId) {
    _unitOfWork.TokenRepository.Delete(x => x.AuthToken == tokenId);
    _unitOfWork.Save();
    var isNotDeleted = _unitOfWork.TokenRepository.GetMany(x => x.AuthToken == tokenId).Any();
    if (isNotDeleted) {
        return false;
    }
    return true;
}

The DeleteByUserId method deletes all the token entries from the database w.r.t specific userId associated with those tokens.

public bool DeleteByUserId(int userId)
{
    _unitOfWork.TokenRepository.Delete(x => x.UserId == userId);
    _unitOfWork.Save();

    var isNotDeleted = _unitOfWork.TokenRepository.GetMany(x => x.UserId == userId).Any();
    return !isNotDeleted;
}

So with _unitOfWork and along with Constructor, our class becomes.

using System;
using System.Configuration;
using System.Linq;
using BusinessEntities;
using DataModel;
using DataModel.UnitOfWork;

namespace BusinessServices {
    public class TokenServices : ITokenServices {
        #region Private member variables.
        private readonly UnitOfWork _unitOfWork;
        #endregion

        #region Public constructor.
        /// <summary>
        /// Public constructor.
        /// </summary>
        public TokenServices(UnitOfWork unitOfWork) {
            _unitOfWork = unitOfWork;
        }
        #endregion

        #region Public member methods.

        /// <summary>
        /// Function to generate unique token with expiry against the provided userId.
        /// Also add a record in database for generated token.
        /// </summary>
        /// <param name="userId"></param>
        /// <returns></returns>
        public TokenEntity GenerateToken(int userId) {
            string token = Guid.NewGuid().ToString();
            DateTime issuedOn = DateTime.Now;
            DateTime expiredOn = DateTime.Now.AddSeconds(Convert.ToDouble(ConfigurationManager.AppSettings["AuthTokenExpiry"]));
            var tokendomain = new Token {
                UserId = userId,
                AuthToken = token,
                IssuedOn = issuedOn,
                ExpiresOn = expiredOn
            };

            _unitOfWork.TokenRepository.Insert(tokendomain);
            _unitOfWork.Save();
            var tokenModel = new TokenEntity() {
                UserId = userId,
                IssuedOn = issuedOn,
                ExpiresOn = expiredOn,
                AuthToken = token
            };

            return tokenModel;
        }

        /// <summary>
        /// Method to validate token against expiry and existence in database.
        /// </summary>
        /// <param name="tokenId"></param>
        /// <returns></returns>
        public bool ValidateToken(string tokenId) {
            var token = _unitOfWork.TokenRepository.Get(t => t.AuthToken == tokenId && t.ExpiresOn > DateTime.Now);
            if (token != null && !(DateTime.Now > token.ExpiresOn)) {
                token.ExpiresOn = token.ExpiresOn.AddSeconds(Convert.ToDouble(ConfigurationManager.AppSettings["AuthTokenExpiry"]));
                _unitOfWork.TokenRepository.Update(token);
                _unitOfWork.Save();
                return true;
            }
            return false;
        }

        /// <summary>
        /// Method to kill the provided token id.
        /// </summary>
        /// <param name="tokenId">true for successful delete</param>
        public bool Kill(string tokenId) {
            _unitOfWork.TokenRepository.Delete(x => x.AuthToken == tokenId);
            _unitOfWork.Save();
            var isNotDeleted = _unitOfWork.TokenRepository.GetMany(x => x.AuthToken == tokenId).Any();
            if (isNotDeleted) {
                return false;
            }
            return true;
        }

        /// <summary>
        /// Delete tokens for the specific deleted user
        /// </summary>
        /// <param name="userId"></param>
        /// <returns>true for successful delete</returns>
        public bool DeleteByUserId(int userId) {
            _unitOfWork.TokenRepository.Delete(x => x.UserId == userId);
            _unitOfWork.Save();

            var isNotDeleted = _unitOfWork.TokenRepository.GetMany(x => x.UserId == userId).Any();
            return !isNotDeleted;
        }

        #endregion
    }
}

Do not forget to resolve the dependency of this Token service in the DependencyResolver class. Add registerComponent.RegisterType<ITokenServices, TokenServices>(); to the SetUp method of the DependencyResolver class in the BusinessServices project.

[Export(typeof(IComponent))]
public class DependencyResolver : IComponent
{
    public void SetUp(IRegisterComponent registerComponent)
    {
        registerComponent.RegisterType<IProductServices, ProductServices>();
        registerComponent.RegisterType<IUserServices, UserServices>();
        registerComponent.RegisterType<ITokenServices, TokenServices>();
    }
}

Setup WebAPI/Controller

Now since we decided that we don't want authentication to be applied on each and every API exposed, I'll create a single Controller/API endpoint that takes authentication or a login request and uses a Token Service to generate a token and respond to client/caller with a token that persists in the database with expiry details.

Add a new Controller under the Controllers folder in the WebAPI with the name Authenticate as in the following.

AuthenticateController

using System.Configuration;
using System.Net;
using System.Net.Http;
using System.Web.Http;
using AttributeRouting.Web.Http;
using BusinessServices;
using WebAPI.Filters;

namespace WebAPI.Controllers
{
    [APIAuthenticationFilter]
    public class AuthenticateController : APIController
    {
        #region Private variable.

        private readonly ITokenServices _tokenServices;

        #endregion

        #region Public Constructor

        /// <summary>
        /// Public constructor to initialize product service instance
        /// </summary>
        public AuthenticateController(ITokenServices tokenServices)
        {
            _tokenServices = tokenServices;
        }

        #endregion

        /// <summary>
        /// Authenticates user and returns token with expiry.
        /// </summary>
        /// <returns></returns>
        [HttpPost("login")]
        [HttpPost("authenticate")]
        [HttpPost("get/token")]
        public HttpResponseMessage Authenticate()
        {
            if (System.Threading.Thread.CurrentPrincipal != null && System.Threading.Thread.CurrentPrincipal.Identity.IsAuthenticated)
            {
                var basicAuthenticationIdentity = System.Threading.Thread.CurrentPrincipal.Identity as BasicAuthenticationIdentity;
                if (basicAuthenticationIdentity != null)
                {
                    var userId = basicAuthenticationIdentity.UserId;
                    return GetAuthToken(userId);
                }
            }
            return null;
        }

        /// <summary>
        /// Returns auth token for the validated user.
        /// </summary>
        /// <param name="userId"></param>
        /// <returns></returns>
        private HttpResponseMessage GetAuthToken(int userId)
        {
            var token = _tokenServices.GenerateToken(userId);
            var response = Request.CreateResponse(HttpStatusCode.OK, "Authorized");
            response.Headers.Add("Token", token.AuthToken);
            response.Headers.Add("TokenExpiry", ConfigurationManager.AppSettings["AuthTokenExpiry"]);
            response.Headers.Add("Access-Control-Expose-Headers", "Token,TokenExpiry");
            return response;
        }
    }
}

The controller is decorated with our authentication filter as in the following.

[APIAuthenticationFilter]
public class AuthenticateController : APIController

So, each and every request coming through this controller will need to through this authentication filter that checks for a BasicAuthentication header and credentials. The Authentication filter sets the CurrentThread principal to the authenticated Identity.

There is a single authentication method/action in this controller. You can decorate it with multiple endpoints as was explained in the fourth part of this series.

[POST("login")]
[POST("authenticate")]
[POST("get/token")]

The Authenticate method first checks for CurrentThreadPrincipal and if the user is authenticated or not, in other words the job is done by the authentication filter.

if (System.Threading.Thread.CurrentPrincipal != null && System.Threading.Thread.CurrentPrincipal.Identity.IsAuthenticated)

When it finds that the user is authenticated, it generates an auth token using TokenServices and returns a user with Token and its expiry.

response.Headers.Add("Token", token.AuthToken);
response.Headers.Add("TokenExpiry", ConfigurationManager.AppSettings["AuthTokenExpiry"]);
response.Headers.Add("Access-Control-Expose-Headers", "Token,TokenExpiry");
return response;

In our BasicAuthenticationIdentity class, I intentionally used the userId property so that we can use this property when we try to generate a token, which we are doing in this controller's Authenticate method.

var basicAuthenticationIdentity = System.Threading.Thread.CurrentPrincipal.Identity as BasicAuthenticationIdentity;
if (basicAuthenticationIdentity != null)
{
    var userId = basicAuthenticationIdentity.UserId;
    return GetAuthToken(userId);
}

Now when you run this application, you'll see the Authenticate API as well, just invoke this API with Basic Authentication and User credentials, and you'll get the token with expiry, let's do this step-by-step.

1. Run the application.
   
2. Click on the first API link, in other words, POST authenticate. You'll get the page to test the API.
   
3. Press the TestAPI button in the right corner. In the test console, provide Header information with the Authorization set for Basic and the user credentials in Base64 format, as we did earlier. Click on Send.
   
4. Now, since we provided valid credentials, we'll get a token from the Authenticate controller, with its expiry time.
   

In the database.

Here we get response 200, in other words, our user is authenticated and logged into the system. The TokenExpiry is 900, in other words, 15 minutes. Note that the time difference between IssuedOn and ExpiresOn is 15 minutes, this we did in the TokenServices class method GenerateToken, you can set the time as needed. The Token is 604653d8-eb21-495c-8efd-da50ef4e56d3. Now for 15 minutes, we can use this token to call our other services. But before that, we should mark our other services to understand this token and respond accordingly. Keep the generated token saved so that we can use it further in calling other services that I am about to explain. So let's set up authorization for other services.

Set Up Authorization Action Filter

We already have our Authentication filter in place and we don't want to use it for authorization purposes. So we need to create a new Action Filter for authorization. This action filter will only recognize a Token coming in requests. It assumes that, requests are already authenticated using our login channel and now the user is authorized/not authorized to use other services like Products in our case, there could be n number of other services too that can use this authorization action filter. For the request to be authorized, we don't need to user credentials. Only a token (received from the Authenticate controller after successful validation) needs to be ed using the request.

Add a folder named ActionFilters to the WebAPI project. And add a class named AuthorizationRequiredAttribute.

Deriving from ActionFilterAttribute.

Override the OnActionExecuting method of ActionFilterAttribute, this is the way we define an action filter in an API project.

using System.Linq;
using System.Net;
using System.Net.Http;
using System.Web.Http.Controllers;
using System.Web.Http.Filters;
using BusinessServices;

namespace WebAPI.ActionFilters
{
    public class AuthorizationRequiredAttribute : ActionFilterAttribute
    {
        private const string Token = "Token";
        public override void OnActionExecuting(HttpActionContext filterContext)
        {
            // Get API key provider
            var provider = filterContext.ControllerContext.Configuration.DependencyResolver.GetService(typeof(ITokenServices)) as ITokenServices;

            if (filterContext.Request.Headers.Contains(Token))
            {
                var tokenValue = filterContext.Request.Headers.GetValues(Token).First();

                // Validate Token
                if (provider != null && !provider.ValidateToken(tokenValue))
                {
                    var responseMessage = new HttpResponseMessage(HttpStatusCode.Unauthorized)
                    {
                        ReasonPhrase = "Invalid Request"
                    };
                    filterContext.Response = responseMessage;
                }
            }
            else
            {
                filterContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
            }
            base.OnActionExecuting(filterContext);
        }
    }
}

The overridden method checks for the “Token” attribute in the Header of every request. If the token is present, it calls the ValidateToken method from TokenServices to check if the token exists in the database. If the token is valid, our request is navigated to the actual controller and the action that we requested, else you'll get an error message saying unauthorized.

Mark Controllers with Authorization filter

We have our action filter ready. Now let's mark our controller ProductController with this attribute. Just open the Product Controller class and at the top just decorate that class with this ActionFilter attribute as in the following.

[AuthorizationRequired]
[RoutePrefix("v1/Products/Product")]
public class ProductController : APIController
{
}

We have marked our controller with the action filter that we created, now every request coming to the actions of this controller will need to be ed using this ActionFilter, which checks for the token in the request.

You can mark other controllers as well with the same attribute, or you can mark it at the action level as well. Assume you want certain actions to be available to all users irrespective of their authorization. Then you can just mark only those actions that require authorization and leave other actions as they are, like I explained in Step 4 of Implementing Basic Authentication.

Maintaining Sessions using Token

We can certainly use these tokens to maintain sessions as well. The tokens are issued for 900 seconds, in other words, 15 minutes. Now we want the user should be able to continue to use this token if he is using other services as well for our application. Or assume there is a case where we only want the user to finish his work on the site within 15 minutes or within his session time before he makes a new request. So when validating the token in TokenServices, what I have done is, to increase the time of the token by 900 seconds whenever a valid request comes with a valid token.

/// <summary>
/// Method to validate token against expiry and existence in database.
/// </summary>
/// <param name="tokenId"></param>
/// <returns></returns>
public bool ValidateToken(string tokenId)
{
    var token = _unitOfWork.TokenRepository.Get(t => t.AuthToken == tokenId && t.ExpiresOn > DateTime.Now);
    if (token != null && !(DateTime.Now > token.ExpiresOn))
    {
        token.ExpiresOn = token.ExpiresOn.AddSeconds(
            Convert.ToDouble(ConfigurationManager.AppSettings["AuthTokenExpiry"]));
        _unitOfWork.TokenRepository.Update(token);
        _unitOfWork.Save();
        return true;
    }
    return false;
}

In the preceding code for token validation, first, we check if the requested token exists in the database and is not expired. We check expiry by comparing it with the current date and time. If it is a valid token then we just update the token into the database with a new ExpiresOn time that is adding 900 seconds.

if (token != null && !(DateTime.Now > token.ExpiresOn)) 
{  
    token.ExpiresOn = token.ExpiresOn.AddSeconds(
        Convert.ToDouble(ConfigurationManager.AppSettings["AuthTokenExpiry"])
    );  
    _unitOfWork.TokenRepository.Update(token);  
    _unitOfWork.Save();  
}

By doing this we can allow the end user or client to maintain the session and continue using our services/application with a session timeout of 15 minutes. This approach can also be leveraged in multiple ways, like making various services with various session timeouts or many such conditions could be applied when we work on actual applications using APIs.

Running the application

Our job is nearly done.

We just need to run the application and test if it is working correctly. If you have saved the token you generated earlier when testing authentication then you can use it to test authorization. I am just again running the entire cycle to test the application.

Test Authentication

Repeat the tests we did earlier to get an Auth Token. Just invoke the Authenticate controller with valid credentials and a Basic authorization header. I get:

And without providing an Authorization header as basic with credentials I get.

I just saved the token that I got in the first request.

Now try to call ProductController actions.

Test Authorization

Run the application to invoke Product Controller actions. Try to invoke them without providing any Token.

Invoke the first service in the list,

Click send.

Here we get Unauthorized, in other words, because our ProductController is marked with the authorization attribute, it checks for a Token. So here our request is invalid. Now try calling this action by providing the token that we saved.

Click on Send and we get.

That means we got the response and our token was valid. Now we see our Authentication and Authorization, functionalities are working fine. You can test Sessions on your own.

Likewise, you can test all actions. You can create other controllers and test the security and play around with sets of permutations and combinations.

Conclusion

We covered and learned a lot. In this article, I tried to explain about how to build an API application with basic Authentication and Authorization. One can mold this concept to achieve the level of security needed. The token generation mechanism could be customized as per one's requirements. Two levels of security could be implemented where authentication and authorization are needed for every service. One can also

implement authorization on actions based on roles.

Image credit: http://www.greencountryfordofparsons.com

I already stated that there is no specific way to do security, the more you understand the concept, the more secure you can make the system. The techniques used in this article or the design implemented in this article should be leveraged well if you use it with Secure Socket Layer (SSL), running the REST APIs on https. In my next article, I'll try to explain some more beautiful implementations and concepts. Until then Happy Coding.

You can also download the complete source code with all packages from Github.

References

• ASP.NET Web API Security Filters
• A WebAPI Basic Authentication Authorization Filter