use asp.net web api token to authenticate on mvc web site

Question

I have the following setup.

2 mobile apps communicating with an asp.net web api 2 project and they use Token Authentication. Each mobile client stores the token client side, never username and password.

I then have my web portal hosted on an asp.net mvc 5project which uses standard cookie authentication.

Now in some cases my mobile apps needs to load webpages from the mvc 5web portal. For example our payment gateway page. But the client needs to be authenticated in order to load this page.

At the moment when we show the user a web wrap of out web portal. It asks them to login again. This is very bad UX.

How can I authenticate the client on the MVC site, using my web api Token

I'm imagining a function like this in the MVC site:

pubic Action LogInWithToken(String token)
{
var user = GetUserFromToken(token);
var isAllowed = AuthenticateUserFromToken(user,token);
if(!isAllowed) return 401;
return CreateCookieForUser(user);
}

You can use custom authorization attribute where you can check the request data and if token exist then validate the user. Check here and search in this regard. — Siva Gopal
– Siva Gopal, Commented Jun 19, 2017 at 5:45
Possible duplicate- stackoverflow.com/questions/38661090/… — Souvik Ghosh
– Souvik Ghosh, Commented Jun 19, 2017 at 5:50
@SivaGopal yes I can do that. but how do you decrypt the token? I still need a way to take the string token and get the user and time stamp from the token. — Zapnologica
– Zapnologica, Commented Jun 19, 2017 at 16:04

dericatienza · Accepted Answer · 2017-06-19 05:51:06Z

1

Is the Web Api 2 application hosted in the same machine as the MVC 5 application?

If they are, you can manually deserialize the token to get the id of the user. See Extract User details from web api auth token in MVC.

From there, you can sign in the user in CookieAuthentication automatically.

If they are hosted in different machines, however, you would have to specify the same machine key in the projects' Web.Config files.

answered Jun 19, 2017 at 5:51

dericatienza

193 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Zapnologica Over a year ago

They are hosted on azure web service, design wise I would like them to be able to scale horizontally so I dono want to rely on them being the same machine. The link u sent requires us to change the API token to use JWT. How can I do it with using the standard API token.

Collectives™ on Stack Overflow

use asp.net web api token to authenticate on mvc web site

1 Answer 1

1 Comment

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Linked

Related