Token-Based Authentication without username and password

In this case you can use Authorization Filter.

Please check below code need to added Authorization Filter in API Project:

public class APIProjectKeyBasedAuthenticationAttribute : AuthorizationFilterAttribute
{
public override void OnAuthorization(HttpActionContext actionContext)
{
IEnumerable<string> apiKeyHeaderValues = null;
if (actionContext.Request.Headers.TryGetValues("X-ApiKey", out apiKeyHeaderValues))
{
var sourceApiKeyHeaderValue = apiKeyHeaderValues.First();
var destinationApiKeyValue = "KeyValue";
if (destinationApiKeyValue != sourceApiKeyHeaderValue)
actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Forbidden, "Bad API Key");
}
else
{
actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
}
}
}

Call API from using same key/token as below code:

public T GetRequest(string URL)
{
try
{
HttpClient _httpClient = new HttpClient();
string domain = string.Empty;
_httpClient.DefaultRequestHeaders.Add("X-ApiKey","KeyValue");
var response = _httpClient.GetAsync(domain + URL).Result;
if (response.StatusCode == HttpStatusCode.OK)
{
var responseContent = response.Content.ReadAsStringAsync();
var responseobj = JsonConvert.DeserializeObject(responseContent.Result);
return responseobj;
}
else
{
Console.WriteLine("Error occured while calling TimeMachine API." + ";URL:" + URL + ";");
return default(T);
}
}
catch (Exception ex)
{
Console.WriteLine("URL:" + URL, ex);
return default(T);
}
}

So in this case it won't require username and password but based on token we set it will authenticate.

4 Replies

Know the answer? Post it — somebody with the same question will find it here.

Vishal Joshi4y ago
In this case you can use Authorization Filter.

Please check below code need to added Authorization Filter in API Project:
public class APIProjectKeyBasedAuthenticationAttribute : AuthorizationFilterAttribute
    {
        public override void OnAuthorization(HttpActionContext actionContext)
        {
            IEnumerable<string> apiKeyHeaderValues = null;
            if (actionContext.Request.Headers.TryGetValues("X-ApiKey", out apiKeyHeaderValues))
            {
                var sourceApiKeyHeaderValue = apiKeyHeaderValues.First();
                var destinationApiKeyValue = "KeyValue";
                if (destinationApiKeyValue != sourceApiKeyHeaderValue)
                    actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Forbidden, "Bad API Key");
            }
            else
            {
                actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
            }
        }
}
Call API from using same key/token as below code:
public T GetRequest(string URL)
        {
            try
            {
                HttpClient _httpClient = new HttpClient();
                string domain = string.Empty;
                    _httpClient.DefaultRequestHeaders.Add("X-ApiKey","KeyValue");

                var response = _httpClient.GetAsync(domain + URL).Result;
                if (response.StatusCode == HttpStatusCode.OK)
                {
                    var responseContent = response.Content.ReadAsStringAsync();
                    var responseobj = JsonConvert.DeserializeObject(responseContent.Result);
                    return responseobj;
                }
                else
                {
                    Console.WriteLine("Error occured while calling TimeMachine API." + ";URL:" + URL + ";");
                    return default(T);
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine("URL:" + URL, ex);
                return default(T);
            }
        }
So in this case it won't require username and password but based on token we set it will authenticate.
Uttam Kumar4y ago
You can create user specific JWT (JSON Web Token) for authentication and authorisation
Ritu4y ago
I have no username and password.
Amit Mohanty4y ago
Check the below link

https://www.c-sharpcorner.com/article/token-based-authentication-using-web-api-2-owin-and-identity/