How to implement security in REST calls in .NET using NANCY and RESTsharp?

How to add security level to REST application, I control my server and client, I use NANCY as a server and RESTsharp as a client.

Itโ€™s hard for me to understand how to make calls safely if REST support is not status.

thanks

+4
source share
1 answer

A Christian comment may be sufficient for your needs. It shows how to use Nancy add-ins for Basic or FormsAuth, and RESTSharp supports Basic auth right out of the box.

I have been working on the Nancy-managed REST API for a long time, we used both RESTSharp and plain HTML + JS as clients, and we decided to implement our own session-based authentication (partly because the add-ons did not exist when we implemented). However, what's nice about this is how easy it is to use, no matter what the client supports. I will quickly explain how this works.

The client sends its username and password (or, if you want, an identifier and a secret key) to create a new session resource using POST /sessions (use HTTPS). This resource contains a session key that can be used for subsequent calls. A session expires after X minutes of inactivity.

Each call made by the service requires a valid session key (other than creating a session). The key is provided either as a cookie or in the query string. When using RESTSharp, we usually set this as a cookie and simply continue to reuse it if it has not expired.

Finally, the session can be destroyed by calling DELETE /session/{key} .

This is a simple but effective way (supposedly HTTPS) to protect the REST API.

Alternatively, you can implement OAuth, which RESTSharp also explicitly supports out of the box.

+4
source

Source: https://habr.com/ru/post/1385706/


All Articles