I have a Web API developed in asp.net. Now I want to log the MAC Address of any incoming request to API. is this possible in c# and how?
Any help would be very much appreciated?
Thank you
Asked
Active
Viewed 5,299 times
0
-
1It does not make sence to get the MAC address because you will only get the MAC address of the last hop (mostly a router at the location of your server) – Flat Eric May 01 '14 at 14:52
-
if thats so, is there any way to uniquely identify an incoming request – user3363268 May 01 '14 at 14:53
-
Maybe you could use cookies or session IDs – Flat Eric May 01 '14 at 14:57
-
that isn't secure enough! I need something like mac address to uniquely identify the request – user3363268 May 01 '14 at 14:59
-
will the mac address be found in the request header, if not please tell me the possible way in a theoretical manner. thank you – user3363268 May 01 '14 at 15:15
-
I know of two ways to uniquely identify web client requests to a site WITHOUT using cookies. However, both are patented. – Keith May 01 '14 at 15:32
1 Answers
1
There is no solution with HTTP protocol. Using ASP.NET you can't get MAC address or other hardware identifiers. You can get IP but many machines will share the same IP if they are behind NAT. The same issue with combination of IP+browser+version.
Depends on your requirements, you may
- rely on cookies as soon as cookies won't be deleted
- create authentication mechanism and send session id for each request
- use HTTPS or the OAuth protocol
Some other ideas: Designing a Secure REST (Web) API without OAuth
user2316116
- 6,726
- 1
- 21
- 35
-
thank you, my actual problem here is I am trying secure the api from relay attacks by blocking the MAC address.. can you suggest me possible ways of achieving this – user3363268 May 01 '14 at 15:38
-
Block by IP. There is a lot of solutions for this: e.g. [HttpModule](http://madskristensen.net/post/block-dos-attacks-easily-in-aspnet), [global.asax-solution](http://blogs.msdn.com/b/friis/archive/2014/04/25/easily-detect-and-block-malicious-http-requests-targeting-iis-asp-net-using-blackips.aspx) – user2316116 May 01 '14 at 16:01
-
-
Take a look at [this post](http://blog.maartenballiauw.be/post/2013/05/28/Throttling-ASPNET-Web-API-calls.aspx) which explains how to use [WebApiContrib ThrottlingHandler](https://github.com/WebApiContrib/WebAPIContrib/) which, for example, can limit anonymous API clients to a maximum of X requests per hour. – user2316116 May 01 '14 at 16:55