Implement security in REST?

Question

I am interested in how to implement security measures, it can be authentication or authorization. How they can be implemented .. if you have any thoughts or links that you can share with WCF REST 4.0 Security, and if you implemented it, so much the better. because ive tried to figure out in this thread all i find is information on how to implement it using versions 3.5 and later, which seem to be different from the samples i see for 4.0 that i tried but did not make sense in its implementation.

thanks

Answer 1

Since REST has no status, you cannot use the cookie or session identifier. Commonly used are HTTP Basic Authentication and HTTPS for all requests.

Answer 2

You might want to explore this solution for WCF REST, this is an interceptor for implementing basic authentication with a user user database.

http://weblogs.asp.net/cibrax/archive/2009/03/20/custom-basic-authentication-for-restful-services.aspx

This interceptor authenticates the user with a password and initializes the current principal, so you can use it from the service itself to perform authorization or implement IAuthorizationManager if you want this logic to be reused for something for several services.

There are other authentication methods on my blog, such as certificate authentication or OAuth, which are less common.

Thanks Pablo.

Answer 3

For authorization you can look at XACML.