Creating REST API for existing MVC based website

Question

I have a website developed using ASP.NET MVC3.
I now want to expose a REST API for others to use which will expose the same features as the website.

In the website, once a user has logged in and credentials validated against a DB, the session manages the logged-in state of the user.
How would I do the equivalent with the REST API, where many of the methods exposed require the user to be logged in (or at least have valid username and password)?

In addition to this, would the best approach for the website be to use the REST API also (presuming the API covers all the functionality required by the site)?

How well is ASP.NET MVC3 suited for this - of course taking into account that the site already exists using this framework?

Answer 1

I wrote up a blog post on how to [Build a RESTful API architecture within an ASP.NET MVC 3 application] years ago and ended up having to let the site go. :( It might be a good start if you want to take on building the REST API into your MVC application.

See answer by @tugberk on using WebAPI for a good solution.

Answer 2

ASP.NET MVC is very well suited for this. Although you can use other approaches (like WCF) I would stick with MVC since you already have a working site that needs to be exposed for other consumers.

See also my other answer:

Which is better for building an API for my website: MVC or Ado.net data services?

Answer 3

Note:

WCF Web API is now ASP.NET Web API and has changed a lot. The beta version is now available. For more information: Getting Started With ASP.NET Web API - Tutorials, Videos, Samples

I would go with WCF Web Api to do that. ASP.NET MVC is also nice and capable of exposing your data but WCF Web Api is more capable if you consider exposing your data to your users. It is easy to use and integrate REST Web APIs to your system.

For the authentication, API Key is always the best way for this type of scenario. Here is a good example on how you can implement API Auth with WCF Web API :

http://weblogs.asp.net/cibrax/archive/2011/04/15/http-message-channels-in-wcf-web-apis-preview-4.aspx

Note:

They just released the preview version 5 couple of weeks ago and Message Channels has been changed to Message Handlers as far as I know. But the above article should give you an idea.

For security implementations, the below might help as well :

wcf Authentication Token Implementation - How to do

Answer 4

ASP .NET MVC is a great choice for this. I have created several ASP MVC that act as RESTful services as well as websites.

To summarize the design paradigm I use, each controller has an action that emits a JSON representation of the requested data. Said data is loaded in a view model on the server, and the built in JSON serializer takes care of the server side, while a jQuery view nicely loads the data back in for my actual webpages to consume.

The site itself has index actions on each controller that emit that necessary markup, but not the data. jQuery document.ready methods on the pages load in the data from what is essentially my rest api, but build right into the site.

Checkout Nerd Dinner for great sample code. http://nerddinner.com/

Concerning security, I think my experience will differ from yours. ASP MVC integrates very nicely with active directory if your users are all in the same domain and have AD credentials. This is the only method I have used, and with ease, success, and satisfaction.

I have had coworkers interact with other APIs that hand out a token upon calling an authorize method. The received token would then be the clients responsibility to store and hand back on each request, but I cannot talk you through implementation details, as I have not person experience on that front.

Answer 5

I would go with a WCF web service based implementation as follows.

• Wrap all your business logic into a separate dll project named as yourproject.businessservices for example
• Create a authentication webservice which will generate a non-repeatable token per user login
• This login stores the essential details of the user along with the token in a Cache like MemCache which should have a sliding expiration
• If the user has not accessed the cache for let's say an hour, the cache expires and the user is logged out

• If the user is using it the cache keeps getting extended.

  On the wcf services side,

• Create APIs to return the token on authentication

• All the wcf methods will have this session id which needs to be validated

  The advantage is that the wcf methods can be exposed to return xml or json format and can also be used as normal web services.

  [WebInvoke(Method = "GET", ResponseFormat = WebMessageFormat.Xml, BodyStyle = WebMessageBodyStyle.Bare, UriTemplate = "/MyModule/XML/GetData/{customerSessionId}")] [WebInvoke(Method = "GET", ResponseFormat = WebMessageFormat.Json, BodyStyle = WebMessageBodyStyle.Wrapped, UriTemplate = "/MyModule/JSON/GetData/{customerSessionId}")]