0

I have a server-client project written in c#. I want to change the client side to a web client so we can open it with the browser. So I decided to make a WCF rest service that will replace the server side. The binding that I am using for the service is webHttpBinding. My problem is with the behavior of the service. The service data (vars etc..) is initialize after every call. If i add the [ServiceBehavior(InstanceContextMode = InstanceContextMode.PerSession)] it doesn't change anything. If I use [ServiceBehavior(InstanceContextMode = InstanceContextMode.Single)], it works but I guess that the service instance will be the same for every client.

I have a simple html web page that get a username and password from the client and post it to the service. The service check the Login info with the user database and response. My problem is that i can't save the user status as logged in or not because after every post/get method the service is reset.

what should I do?

Avi Thalker
  • 49
  • 3
  • 14
  • You don't need a *Session*. You can implement ,for ex, *BasicAuthentication*. See [this example](http://stackoverflow.com/questions/15915545/how-to-implement-webservicehost-authentication) – EZI Apr 14 '15 at 18:37

1 Answers1

0

This is a pretty standard issue you have to deal with when trying to maintain a session over HTTP, which is what webHttpBinding is using. Even if you try to force it to have a session, it won't. RESTful services don't work that way.

A high level overview of what you have to do is have the service create a token it gives the client upon initial authentication (probably to be stored in a cookie), which the client will then send back with each request. The service can then use that token to check if the client is logged into a particular account with each request. You probably want to make tokens expire after a certain duration (might be 1 month, 1 week, 1 day, 10 minutes, depending on your application).

You can find some more information here:

RESTful Authentication

SPA best practices for authentication and session management

Authentication, Authorization and Session Management in Traditional Web Apps and APIs

Community
  • 1
  • 1
Dan Field
  • 20,885
  • 5
  • 55
  • 71