Question

http://localhost:1075/api/customer/Getcustomer?id=1

1.以上url得到我的特定用户个人资料信息的结果..以下是控制器代码。这个web api为Android应用程序调用和设计。但即使我从我的浏览器或邮差工具调用它它给我结果。安全在哪里？如果有人知道这个网址，那么他可以访问我们所有的sesitive信息。请建议我如何保护我的网络API ...

 public customerCollection Getcustomer(int id)
        {          
            db.Configuration.ProxyCreationEnabled = false;
            var customer = (from c in db.customers
                                 where c.customerID == id
                                 select c).ToArray();
            var result = new customerCollection();
            if (customer == null)
            {
                result.status = "failed";
            }
            result.status = "success";
            result.customerArray = customer;
            return result;
        }

响应是

{
  "customerArray": [
    {
      "customerID": 1,
      "cname": "Yogesh",
      "cmobile": "9970714878",
      "cemail": "yogeshkhurpe11@gmail.com",
      "cpassword": "yogesh",
      "addressLine1": "balaji hostel",
      "addressLine2": "Jadhav nagar",
      "area": "Vadgoan",
      "pincode": "411041",
      "cimage": "Na",
      "cdate": "2017-06-28T14:16:03",
      "cstatus": "active",
      "orders": []
    }
  ],
  "status": "success"
}

Answer 1

以下是使用身份验证的分步方法。

您应该在WebAPI中创建一个Authorize属性，以便首先授权传入的请求。

首先，将要使用您的API的用户将使用用户名和密码对自己进行身份验证，一旦此过程完成并且用户已获得授权，您应该向用户返回令牌以获取进一步的请求。此令牌可以是加密时间或GUID，也可以是您希望了解的有关特定用户的任何内容，您已为其生成该令牌。您可以将该令牌保存到数据库中以供进一步使用。

现在，下次用户尝试访问您的API时，他会在该api请求的标头部分发送令牌。如果令牌有效，则应返回结果，否则应返回错误，指出令牌无效。

由于希望这有帮助！

Answer 2

尝试以下逻辑。首先在WebAPI中创建一个Authorize属性。使用api函数上方的Authorize属性来保护api的

public class AuthenticationFilter : AuthorizationFilterAttribute
        {
            /// <summary>
            /// read requested header and validated
            /// </summary>
            /// <param name="actionContext"></param>
            public override void OnAuthorization(HttpActionContext actionContext)
            {
                var identity = FetchFromHeader(actionContext);

                if(identity != null)
                {
                    //get the user based on the identity
                    var user=TokenService.getUserFromToken(identity);
                    if (user)
                    {
                        CurrentThread.SetPrincipal(new GenericPrincipal(new GenericIdentity(user), null), null, null);
                    }
                    else
                    {
                        actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
                        return;
                    }
                }
                else
                {
                    actionContext.Response = new HttpResponseMessage(HttpStatusCode.BadRequest);
                    return;
                }
                base.OnAuthorization(actionContext);
            }

            /// <summary>
            /// retrive header detail from the request 
            /// </summary>
            /// <param name="actionContext"></param>
            /// <returns></returns>
            private string FetchFromHeader(HttpActionContext actionContext)
            {
                string requestToken = null;

                var authRequest = actionContext.Request.Headers.Authorization;
                if (authRequest != null && !string.IsNullOrEmpty(authRequest.Scheme) && authRequest.Scheme == "Basic")
                    requestToken = authRequest.Parameter;

                return requestToken;
            }
        }

如何在mvc 4中保护我的web api

2 个答案: