Client Validation Using Basic Authentication in Web API

Back to: ASP.NET Web API Tutorial

Client validation using Basic Authentication is a straightforward and widely used method to secure ASP.NET Web API endpoints. This guide will provide a detailed lesson on implementing Basic Authentication for client validation, along with code examples and best practices.

Prerequisites

Before you begin, ensure you have the following:

1. A basic understanding of ASP.NET Web API.
2. Visual Studio or a code editor of your choice.
3. Familiarity with C# and HTTP protocols.

What is Basic Authentication?

Basic Authentication is a simple authentication mechanism where the client sends a username and password with each HTTP request. The server validates the credentials and, if valid, grants access to the requested resource.

Step 1: Create a Custom Authorization Filter

Start by creating a custom authorization filter to handle Basic Authentication. In your ASP.NET Web API project, create a class that inherits from AuthorizationFilterAttribute.

using System;
using System.Net;
using System.Net.Http;
using System.Text;
using System.Web.Http.Filters;

public class BasicAuthenticationAttribute : AuthorizationFilterAttribute
{
    public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        if (actionContext.Request.Headers.Authorization == null)
        {
            actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
        }
        else
        {
            string authenticationToken = actionContext.Request.Headers.Authorization.Parameter;
            string decodedAuthenticationToken = Encoding.UTF8.GetString(Convert.FromBase64String(authenticationToken));
            string[] usernamePasswordArray = decodedAuthenticationToken.Split(':');
            string username = usernamePasswordArray[0];
            string password = usernamePasswordArray[1];

            if (IsAuthorizedUser(username, password))
            {
                base.OnAuthorization(actionContext);
            }
            else
            {
                actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
            }
        }
    }

    private bool IsAuthorizedUser(string username, string password)
    {
        // Implement your custom logic to validate the username and password here.
        // You may check against a database, user store, or any other authentication source.
        // Return true if the user is valid, otherwise false.
    }
}

This custom BasicAuthenticationAttribute class checks for the presence of the Authorization header, decodes the credentials, and calls the IsAuthorizedUser method to validate the user.

Step 2: Apply the Authorization Filter

Apply the BasicAuthenticationAttribute filter to the controller or action methods that require authentication.

[BasicAuthentication]
public class SecureController : ApiController
{
    // This controller or action is secured with Basic Authentication
}

Step 3: Testing Basic Authentication

To test Basic Authentication, send an HTTP request with the Authorization header containing the Base64-encoded credentials.

GET https://yourapi.com/api/secure-resource
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Replace dXNlcm5hbWU6cGFzc3dvcmQ= with the Base64-encoded username:password credentials.

Conclusion

By following this comprehensive guide, you’ve successfully implemented Basic Authentication for client validation in ASP.NET Web API. Basic Authentication provides a simple yet effective way to secure your API endpoints, ensuring that only authorized clients can access protected resources. Customize the BasicAuthenticationAttribute to meet your specific requirements for username and password validation.