I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization.

After a lot of googling and poking around sample projects, I'm not sure where to start. I've found a ton of material from 2008 and 2009 but not a whole lot of recent guides/workflows for WebAPI / single page apps. I think the workflow should be as follows:

  1. Check to see if the user is logged in: How can this be done with javascript? Do I send a cookie to my webAPI? If so, do I send that cookie as a parameter in the body of the request?

  2. Let the user log in / register: How is this data encrypted/decrypted? Surely I can't be sending passwords over the wire... is this where SSL comes in?

  3. Provide them with access to what they have rights to access: I think I got this - I can just authorize in the controllers on a per-request basis.

Any info would be awesome.

2 Answers 2


The easiest way is to use an SSL connection, have them provide authentication credentials and then return a session token to be used with future requests for that session. You can then expire the session token after whatever time amount you want (at which point it would be necessary for them to send another authentication message.)

That's of course assuming that there is no built in session management in WebAPI. It's a bit before my time so I'm not all that familiar with it. I mostly ended up using WCF based services where there is a lot done for you in terms of session management.

  1. Cookies are used to maintain sessions, but do have many lurking dangers. Ensure the data being passed back & forth is well encrypted, TTL value is not too long, and use methods that are known to work (best not to re-invent the wheel) http://msdn.microsoft.com/en-us/library/ms972338.aspx outlines how .net handles sessions.

  2. Login / registering (or any sensitive data) NEEDS to be encrypted over the wire. Sniffing is not that hard and if you are worried about security, that is THE first step.

  3. Access rights are good to lock down within the web app. However, you should also lock down the web server, box it is running on, any open ports, etc. https://www.owasp.org/index.php/Main_Page is a good read and place to start for understanding and implementing web application security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.