ASP.NET Web API – Sigurnosna pitanja i odgovori Ivan Marković Cloud Solutions Program Manager/Technology Evangelist SPAN

ASP.NET Web API in Modern Architecture ASP.NET Web API

About me Ivan Marković SPAN Cloud Solutions Program Manager/Technology evangelist Student

Agenda 1. ASP.NET Web API Pipeline 2. OAuth 2.0

ASP.NET Web API Pipeline

Request Lifecylce Application Domain WebAPIApplication: HttpApplication RouteTable.Routes HttpWebRoute:Route HttpControllerRouteHa ndler:IRouteHandler HttpControllerHandleer: IHttpAsyncHandler::IHttp[ Handler HttpControllerDispatcher :DelegatingHandler HttpRoutingDispatcher: Delegating Handler AllRoutesHandler: Delegating Handler HttpServer: DelegatingHandler ActionFilters ApiController: IHttpController Http Context, Http Request, Http Response AuthorizationFilters PerRouteHandler: Delegating Handler

Request Lifecylce Application Domain WebAPIApplication: HttpApplication RouteTable.Routes HttpWebRoute:Route HttpControllerRouteHa ndler:IRouteHandler HttpControllerHandleer: IHttpAsyncHandler::IHttp[ Handler HttpControllerDispatcher :DelegatingHandler HttpRoutingDispatcher: Delegating Handler AllRoutesHandler: Delegating Handler HttpServer: DelegatingHandler ActionFilters ApiController: IHttpController Http Context, Http Request, Http Response AuthorizationFilters PerRouteHandler: Delegating Handler

Pipeline in Web API 2.0 HttpModuleMessageHandlerAuthentication Filter Authorization Filter Host/Framework independent concerns Web API cross- cutting concerns, eg. CORS Web API specific authentication Authorization

HTTP Module Allow security code to execute early as part of the IIS pipeline. The principal established from an HTTP module is available to all components The biggest drawback with HTTP modules is the lack of granularity.

Message Handler Runs before Authentication and Authorization filters Message handler runs only for Web API requests. A message handler can be configured to run as a global handler for all requests or for a specific route. The downside of using a message handler is the lack of finer control.

Action Filter Another extensibility option provided by ASP.NET Web API It runs after the authorization filters are run in the ASP.NET Web API pipeline.

Authentication vs Authorization AuthenticationAuthorization Authentication is knowing the identity of the user. Eg: Login() Authorization is deciding whether a user is allowed to perform an action. Eg: Read, Write, Delete

Authorization Filter Another extensibility option provided by ASP.NET Web API The order of execution of authorization filters isn’t guaranteed by ASP.NET Web API.

Authentication Filter Authentication filters run after message handlers but before all other filter types. Authentication filters run before authorization filters! Authentication filters offer a level of control or granularity that makes them particularly useful.

Authentication Filter + Authorization Filter Authentication Filter Authorization Filter Action Method No Action Taken Does Not Execute Rejects the Reqouest for the Lack of Authenticate Principal Request with no Credential Unathorized Response 401

Authentication Filter + Authorization Filter Authentication Filter Authorization Filter Action Method contex.ErrorResult Is Set to Unathorized Result Does Not Execute Request with Invalid Credential Unathorized Response Does Not Execute

Authentication Filter + Authorization Filter Authentication Filter Authorization Filter Action Method Contex.Principal Is Set to an Authenticated Princiapl Action Method Runs and Produces a Response Successfully Authorizes Because Identity is Authentic Request with Valid Credential Response Message No Action Taken

ASP.NET Web API Pipeline Demo

OAuth 2.0

Enterprise Security

Modern Applications UsersClientsWeb APIs

OAuth 2.0 User Client Application Authentication Server Resource Server

OAuth 2.0 User Client Application Authentication Server Resource Server

OAuth 2.0 User Client Application Authentication Server Resource Server Access token

OAuth 2.0 User Client Application Authentication Server Resource Server Access token { „iss”:”myAuthzServer”, „aud”:”application”, „exp”:” ”, „scope”:[„search”,”read”], „client_id”:”client1” }

Conclusion HttpModuleMessageHandlerAuthentication Filter Authorization Filter Host/Framework independent concerns Web API cross- cutting concerns, eg. CORS Web API specific authentication Authorization

Conclusion User Client Application Authentication Server Resource Server

Q & A ? ? ? ? ? ? ?