ASP.NET Web API Security Essentials

Rajesh Gunasundaram

• Publisher: Packt Publishing
• Year: 2015
• ISBN:
  9781785882210
• Edition: 1
• Topic: Computer Science
• Subtopic: Application Development
• Index: Computer Science

Take the security of your ASP.NET Web API to the next level using some of the most amazing security techniques around

About This Book

• This book has been completely updated for ASP.NET Web API 2.0 including the new features of ASP.NET Web API such as Cross-Origin Resource Sharing (CORS) and OWIN self-hosting
• Learn various techniques to secure ASP.NET Web API, including basic authentication using authentication filters, forms, Windows Authentication, external authentication services, and integrating ASP.NET's Identity system
• An easy-to-follow guide to enable SSL, prevent Cross-Site Request Forgery (CSRF) attacks, and enable CORS in ASP.NET Web API

Who This Book Is For

This book is intended for anyone who has previous knowledge of developing ASP.NET Web API applications. Good working knowledge and experience with C# and.NET Framework are prerequisites for this book.

What You Will Learn

• Secure your web API by enabling Secured Socket Layer (SSL)
• Manage your application's user accounts by integrating ASP.NET's Identity system
• Ensure the security of your web API by implementing basic authentication
• Implement forms and Windows authentication to secure your web API
• Use external authentication such as Facebook and Twitter to authenticate a request to a web API
• Protect your web API from CSRF attacks
• Enable CORS in your web API to explicitly allow some cross-origin requests while rejecting others
• Fortify your web API using OAuth2

In Detail

This book incorporates the new features of ASP.NET Web API 2 that will help you to secure an ASP.NET Web API and make a well-informed decision when choosing the right security mechanism for your security requirements.

We start by showing you how to set up a browser client to utilize ASP.NET Web API services. We then cover ASP.NET Web API's security architecture, authentication, and authorization to help you secure a web API from unauthorized users. Next, you will learn how to use SSL with ASP.NET Web API, including using SSL client certificates, and integrate the ASP.NET Identity system with ASP.NET Web API.

We'll show you how to secure a web API using OAuth2 to authenticate against a membership database using OWIN middleware. You will be able to use local logins to send authenticated requests using OAuth2. We also explain how to secure a web API using forms authentication and how users can log in with their Windows credentials using integrated Windows authentication. You will come to understand the need for external authentication services to enable OAuth/OpenID and social media authentication. We'll then help you implement anti-Cross-Site Request Forgery (CSRF) measures in ASP.NET Web API.

Finally, you will discover how to enable Cross-Origin Resource Sharing (CORS) in your web API application.

Style and approach

Each chapter is dedicated to a specific security technique, in a task-based and easy-to-follow way. Most of the chapters are accompanied with source code that demonstrates the step-by-step guidelines of implementing the technique, and includes an explanation of how each technique works.

ASP.NET Web API Security Essentials

---

Table of Contents

ASP.NET Web API Security Essentials

Credits

About the Author

Acknowledgments

About the Reviewer

www.PacktPub.com

Support files, eBooks, discount offers, and more

Why subscribe?

Free access for Packt account holders

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Downloading the example code

Errata

Piracy

Questions

1. Setting up a Browser Client

ASP.NET Web API security architecture

Setting up your browser client

Implementing Web API lookup service

Adding a model

Adding a controller

Consuming the Web API using JavaScript and jQuery

Getting a list of contacts

Getting a contact by ID

Running the application

Authentication and authorization

Authentication

Authorization

Implementing authentication in HTTP message handlers

Setting the principal

Using the [Authorize] attribute

Global authorization filter

Controller level authorization filter

Action level authorization filter

Custom authorization filters

Authorization inside a controller action

Summary

2. Enabling SSL for ASP.NET Web API

Enforcing SSL in a Web API controller

Using client certificates in Web API

Creating an SSL Client Certificate

Configuring IIS to accept client certificates

Verifying Client Certificates in Web API

Summary

3. Integrating ASP.NET Identity System with Web API

Creating an Empty Web API Application

Installing the ASP.NET Identity NuGet packages

Setting up ASP.NET Identity 2.1

ASP.NET Identity

Defining Web API Controllers and methods

Testing the application

Summary

4. Securing Web API Using OAuth2

Hosting OWIN in IIS and adding Web API to the OWIN pipeline

Individual User Account authentication flow

Sending an unauthorized request

Get an access token

Send an authenticated request

Summary

5. Enabling Basic Authentication using Authentication Filter in Web API

Basic authentication with IIS

Basic authentication with custom membership

Basic authentication using an authentication filter

Setting an authentication filter

Action-level authentication filter

Controller-level authentication filter

Global-level authentication filter

Implementing a Web API authentication filter

Setting an error result

Combining authentication filters with host-level authentication

Summary

6. Securing a Web API using Forms and Windows Authentication

Working of Forms authentication

Implementing Forms authentication in Web API

What is Integrated Windows Authentication?

Advantages and disadvantages of using the Integrated Windows Authentication mechanism

Configuring Windows Authentication

Difference between Basic Authentication and Windows authentication

Enabling Windows authentication in Katana

Summary

7. Using External Authentication Services with ASP.NET Web API

Using OWIN external authentication services

Creating an ASP.NET MVC Application

Implementing Facebook authentication

Implementing Twitter authentication

Implementing Google authentication

Implementing Microsoft authentication

Discussing authentication

Summary

8. Avoiding Cross-Site Request Forgery Attacks in Web API

What is a CSRF attack?

Anti-forgery tokens using HTML Form or Razor View

How does an Anti-forgery token work?

Anti-forgery tokens using AJAX

Summary

9. Enabling Cross-Origin Resource Sharing (CORS) in ASP.NET Web API

What is CORS?

How CORS works

Setting the allowed origins

Setting the allowed HTTP methods

Setting the allowed request headers

Setting the allowed response headers

Passing credentials in cross-origin requests

Enabling CORS at various scope

Enable at action level

Enable at controller level

Enable CORS globally

Summary

Index

ASP.NET Web API Security Essentials

Copyright © 2015 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

First published: November 2015

Production reference: 1241115

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham B3 2PB, UK.

ISBN 978-1-78588-221-0

www.packtpub.com

Credits

Author

Rajesh Gunasundaram

Reviewer

Anuraj Parameswaran

Commissioning Editor

Amarabha Banerjee

Acquisition Editor

Prachi Bisht

Content Development Editor

Anish Dhurat

Technical Editor

Danish Shaikh

Copy Editor

Vibha Shukla

Project Coordinator

Harshal Ved

Proofreader

Safis Editing

Indexer

Mariammal Chettiyar

Production Coordinator

Nilesh Mohite

Cover Work

Nilesh Mohite

Ab...

Table of contents

• ASP.NET Web API Security Essentials