4

I have to implement a web site (MVC4/Single Page Application + knockout + Web.API) and I've been reading tons of articles and forums but I still can't figure out about some points in security/authentication and the way to go forward when securing the login page and the Web.API.

The site will run totally under SSL. Once the user logs on the first time, he/she will get an email with a link to confirm the register process. Password and a “salt” value will be stored encrypted in database, with no possibility to get password decrypted back. The API will be used just for this application.

I have some questions that I need to answer before to go any further:

  1. Which method will be the best for my application in terms of security: Basic/ SimpleMembership? Any other possibilities?
  2. The object Principal/IPrincipal is to be used just with Basic Authentication?
  3. As far as I know, if I use SimpleMembership, because of the use of cookies, is this not breaking the RESTful paradigm? So if I build a REST Web.API, shouldn't I avoid to use SimpleMembership?
  4. I was checking ThinkTecture.IdentityModel, with tokens. Is this a type of authentication like Basic, or Forms, or Auth, or it's something that can be added to the other authentication types?

Thank you.

Scheveningen
  • 69
  • 2
  • 14

2 Answers2

4

Most likely this question will be closed as too localized. Even then, I will put in a few pointers. This is not an answer, but the comments section would be too small for this.

  1. What method and how you authenticate is totally up to your subsystem. There is no one way that will work the best for everyone. A SPA is no different that any other application. You still will be giving access to certain resources based on authentication. That could be APIs, with a custom Authorization attribute, could be a header value, token based, who knows! Whatever you think is best.
  2. I suggest you read more on this to understand how this works.
  3. Use of cookies in no way states that it breaks REST. You will find ton of articles on this specific item itself. Cookies will be passed with your request, just the way you pass any specific information that the server needs in order for it to give you data. If sending cookies breaks REST, then sending parameters to your API should break REST too!
  4. Now, a very common approach (and by no means the ONE AND ALL approach), is the use of a token based system for SPA. The reason though many, the easiest to explain would be that, your services (Web API or whatever) could be hosted separately and your client is working as CORS client. In which case, you authenticate in whatever form you choose, create a secure token and send it back to the client and every resource that needs an authenticated user, is checked against the token. The token will be sent as part of your header with every request. No token would result in a simple 401 (Unauthorized) or a invalid token could result in a 403 (Forbidden).

No one says an SPA needs to be all static HTML, with data binding, it could as well be your MVC site returning partials being loaded (something I have done in the past). As far as working with just HTML and JS (Durandal specifically), there are ways to secure even the client app. Ultimately, lock down the data from the server and route the client to the login screen the moment you receive a 401/403.

If your concern is more in the terms of XSS or request forging, there are ways to prevent that even with just HTML and JS (though not as easy as dropping anti-forgery token with MVC).

My two cents.

Sujesh Arukil
  • 2,469
  • 16
  • 37
  • Sujesh, thanks so much for your answer. I know SPA is no different that any other application, I just tried to set the scenario in order to make it clearer to possible answers. I understand what you mean on answer 1, but I guess every way to make authentication will have advantages/disadvantages. About your last comment about tokens, I had in mind the use of AntiForgeryToken attribute and I know how to use it, but if I decide to go for a token based system authentication, does it mean I have to send, in my request to the API, two tokens? (authentication and AntyForgery). – Scheveningen Apr 30 '13 at 00:36
  • Thats correct. Typically, the antiforgery token is nothing but a hidden field with the token, which is then submitted with every form submit. In this case, if you are working with just HTML, you will be explicitly reading the token (drop the token on your main index, or come up with a way, it does depend on authentication) and then send it as part of your headers in you ajax request. – Sujesh Arukil Apr 30 '13 at 12:37
3

If you do "direct" authentication - meaning you can validate the passwords directly - you can use Basic Authentication.

I wrote about it here: http://leastprivilege.com/2013/04/22/web-api-security-basic-authentication-with-thinktecture-identitymodel-authenticationhandler/

In addition you can consider using session tokens to get rid of the password on the client: http://leastprivilege.com/2012/06/19/session-token-support-for-asp-net-web-api/

leastprivilege
  • 18,196
  • 1
  • 34
  • 50