2

I'm new to WebAPI and before I dive too deep, I would like to first secure the Web API application first. After days of research, I just found one approach that's straight forward.

Looking over this post How to secure an ASP.NET Web API, I understand overall how it works and it's great there is a github source for it too. (Most answers I found just describe the generic concept with no code to back it up)

My question is, how do you store this "Shared Secret Key" on the server which typically is user's password? I'm doing a ASP.NET MVC 4 app with provided membership provider and it stores the user passwords with salt.

Obviously, the salt value is randomly generated per user and it's not likely the end user knows what their salt value is.

So then, what do you do?

PS: Am I missing some well known frameworks that handle this? I know Microsoft encourages mobile app developments and want developers to create new apps, but how am I suppose to do this when I can't even build authentication for Web API easily? Sorry, just a bit frustrated.

Community
  • 1
  • 1
Liming
  • 1,641
  • 3
  • 28
  • 38

1 Answers1

0

HMAC is not typically used for authenticating users to an API. It's typically used to authenticate "trusted" systems to an API. Example: Company A wants to access Company B's protected API, but doesn't need to authenticate at the user level.

When doing HMAC, you need to have the shared secret available in clear text on both the client and server so that both systems can create the exact same request signature hash. Although you may want to store the shared secret in an encrypted format, it must be a two-way (reversible) encryption.

Daniel Auger
  • 12,535
  • 5
  • 52
  • 73
  • Thanks @Daniel. That makes sense and in that case, it's not exactly what I need to protect the Web API then. Got to keep on searching. Greatly appreciate it. – Liming Jun 20 '13 at 02:06
  • Actually never mind. I might be over-thinking this a bit as Twitter API, we also need to store the consumer key and consumer secret on client side to encrypt first before making authentication request. – Liming Jun 20 '13 at 02:49