1

I am implementing Authentication/Authorization in our Webapi.Currently its working in basic http authentication which is ofcourse just authentication.

We have to implement Role based authorization. What the best practice to go this way.

I am thinking to generate a token based on authentication and was wondering if there is any to contain information in token that can tell me about user, its role , expiration date etc. This token will be passed back and forth with every request.

How do i check for expiration of this token and extract information. I am thinking not to store it in db to query database again for every requestto see if it expired or not. Whats the right way to do this.

I am open to suggestions and want to see whats being done related to this.

I am thinking to design our controller in a way that the REST url are transparent to the consumers of our services. In Controller/HttpHandler we are able to figure out which role this id belongs to and bring the data accordingly.

Please suggest

Tabish Sarwar
  • 1,505
  • 1
  • 11
  • 18
  • 1
    Check this answer to the same question about using an AuthorizationFilterAttribute here: http://stackoverflow.com/questions/9881506/cross-platform-authentication-using-asp-net-web-api – Disco Banana Nov 29 '12 at 14:29

0 Answers0