Using secure WebAPI services from a JavaScript SPA

In this session, I will walk you through the process of setting up a WebAPI service and how to secure it by using MS Identity and the OWIN middleware.

I will also show the steps involved on how to get authenticated and create a JavaScript single page application including authentication to access the Web API service, and get its data in return.

Transcript

1. Using a Secure WebAPI Web Service from a mobile app Don Wibier Technical Evangelist
2. Agenda WEBAPI: what, why? Create WebAPI Service Consume WebAPI Service Using WebAPI
3. Terms Using WebAPI WEBAPI REST ENDPOINTS JSON OAUTH
4. Define Using WebAPI wikipedia.org A web API is a subset of an application programming interface (API)
5. Define Using WebAPI API – Why? blogs.msdn.com/b/martinkearn
6. REST & HTTP Using WebAPI wikipedia.org
7. EndPoints Using WebAPI httpbin.org
8. OAuth Using WebAPI community.hpe.com
9. Authentication Using WebAPI And Authorization
10. Using WebAPI Create a Secure WebAPI Web Service
11. How to secure… Using WebAPI 1. Decorating the WebAPI Controller • Use the [Authorize(..)] attribute 2. Decorating individual Action Methods • Exclusions on Controller attributes ([OverrideAuthentication(..)], [AllowAnonymous]) • Individual methods to be secure ([Authorize(..)])
12. Authorize Using WebAPI AllowAnonymous ?
13. Authorize Using WebAPI Restrict by
14. Application/Client types Using WebAPI Same-Domain • Web APIs and clients live in the same domain • all security settings inherited from web host Cross-Domain • Web APIs and clients live in different domains • native apps (desktop, mobile) • client side JavaScript code (browser) • Web API specific security settings @leastprivelege
15. Using WebAPI Consume Secure WebAPI Web Service
16. Credential Flow Using WebAPI Local login
17. Client side Using WebAPI Send authenticated request
18. Best Practices IIS IIS Express Controller Action [RequireHttps] dxpr.es/api-ssl Using WebAPI Use SSL blog.cloudflare.com
19. Best Practices API design guidance RESTful API design Pragmatic RESTful API Using WebAPI KISS maxoffsky.com
20. Best Practices API Management Azure, apigee, etc. Using WebAPI Cloud
21. Tips Metadata – Swagger.io Programmableweb.com Using WebAPI Go Public?
22. donw@devexpress.com @donwibier Thank You!