We help IT Professionals succeed at work.

mvc api security

ITsolutionWizard
ITsolutionWizard asked
on
4 Comments
1 Solution
124 Views
Last Modified: 2019-01-28
Assume I have super simple MVC API. Our customer will use html jquery to consume the API.
I want to add one token per customer. for example,


customer A token: asdfasdfasfasfasd
customer B token: 23423423423234dsf


1. If the customer's webpage put above token there to consume my API, it has security concern because I can see the token in view source.
2. What is the simple way to implment API with token? I only have 2 to 5 API so I do not need very complex one.

[System.Web.Http.HttpGet]
        public string Get(string firstname)
	{
return firstname;

}

Open in new window

Comment
Watch Question

View Solution Only

KimputerIT Manager
CERTIFIED EXPERT

Commented:
I'm not sure what you mean with "I can see the token in the view source", as you are the server and programmer, how is that an issue?
Anyway, if you want to make it more secure, the session HAS to start with a login form. After hashing, salting and checking against the user database, and the login is successful, issue a cookie and check this cookie for the rest of the session.
Obviously, you probably need 5 times the amount of code you didn't expect you'd need. But with any time of security, you'll have to do some more work.
ITsolutionWizardIT

Author

Commented:
Thank You. But let me tell you more in details.
All I need is to give API - end point to our customer. It is actually the company. I will give them end point and token so their company develop can consume our API using e.g. jquery ajax to consume/read the information through API.

No one will login in this situation.
IT Systems Analyst
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
Jose Gabriel Ortega CastroTop-Rated Plus Freelancer (Upwork)/EE Solution Guide / CEO / Photographer
CERTIFIED EXPERT
Awarded 2018
Distinguished Expert 2018

Commented:
The solution is to use a "POST" call instead of a GET :)

[HttpPost]

        public string Get(string firstname)
	{
//validate request and token as header then return
return firstname;

}

Open in new window

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions