Web API Development Using Client Credential and Auth Code

Nicholas Coppola 0

Good Morning,

I am trying to architect a Web API solution that involves potentially, a user facing web interface that offers functionality to non-registered users, as well as registered users. This would define two scopes within the application; the API endpoints that are accessible to both non-registered and registered users, and the API endpoints that are only accessible to registered users.

My initial thinking was that I would build a separate Authorization solution, which would obviously have its own endpoints, but that would allow for Client Credential Authentication (and implied Authorization for non-registered users) and Auth Code (for registered users).

A distinct Authorization solution would allow the authentication to be combined with the client (application) id, so that I could know within the particular application what the user or public was authorized to do, i.e. which end points of the API they could access.

I'm concerned about the Client Credential piece and want to make sure I'm not exposing the architecture to a man-in-the-middle exploit. I think that because I'm using C# and server-side coding I might be able to avoid this, but I'm not sure.

I'm hoping that someone might have either a resource that I can look at or other ideas on a best practice approach to this. It is possible that I may need to incorporate and second Auth server that is corporate, but that is yet to be determined.

I would greatly appreciate any thoughts, ideas, direction that you might have to offer.

Thank you,

Nick

Jiale Xue - MSFT 42,151 Reputation points Microsoft Vendor

2023-10-27T01:54:37.9166667+00:00

Hi @Nicholas Coppola , Welcome to Microsoft Q&A,

Do you want to create a Asp.net web project?
Nicholas Coppola 0 Reputation points

2023-10-27T02:39:28.45+00:00

Hi Jiale,

Yes, I've created both wcf and web API applications using C# and ASP.NET. I have a new API requirement. This API would be accessed by more than one client application (web user interface). Each interface would have its own Authorization and one would be an Auth server that we manage.

We may not need two scopes because what matters is that a) the client app recognizes the logged-in person, and b) the API (Resource) recognizes the client application.
Nicholas Coppola 0 Reputation points

2023-10-27T02:46:18.3233333+00:00

Duplicate comment
Lan Huang-MSFT 28,821 Reputation points Microsoft Vendor

2023-10-27T06:48:49.31+00:00

Hi @Nicholas Coppola,

From my understanding, maybe you can set an authentication filter and then authorize. In Web API, authentication filters handle authentication, but not authorization.

Authentication Filters in ASP.NET Web API 2

You can use the [Authorize] attribute to restrict access for specific actions. You can also restrict access to specific users or users with specific roles.

Web API provides a built-in authorization filter, AuthorizeAttribute. This filter checks whether the user is authenticated. If not, it returns HTTP status code 401 (Unauthorized), without invoking the action.

Authentication and Authorization in ASP.NET Web API

Share via

Web API Development Using Client Credential and Auth Code