Ram's Network

Basic HTTP Authentication

In basic HTTP authentication the client passes their username and password in the HTTP request header. Typically, using this technique we encrypt user credentials string into base64 encoded string and decrypt this base64 encoded string into plain text. You can also use another encryption and decryption technique.

Custom Principal

Since WebAPI is build on the top of ASP.NET Framework, hence it can use ASP.NET Framework features like ASP.NET membership and provider. ASP.NET provides IPrincipal and IIdentity interfaces to represents the identity and role for a user. For ASP.NET Web API, you can also create a custom solution by evaluating the IPrincipal and IIdentity interfaces which are bound to the HttpContext as well as the current thread.

1. publicclassCustomPrincipal:IPrincipal
2. {
3. publicIIdentityIdentity{ get;privateset;}
4. publicboolIsInRole(string role)
5. {
6. if(roles.Any(r => role.Contains(r)))
7. {
8. returntrue;
9. }
10. else
11. {
12. returnfalse;
13. }
14. }
15.  
16. publicCustomPrincipal(string Username)
17. {
18. this.Identity=newGenericIdentity(Username);
19. }
20.  
21. publicintUserId{ get;set;}
22. public string FirstName{ get;set;}
23. public string LastName{ get;set;}
24. public string[] roles { get;set;}
25. }

Now you can put this CustomPrincipal objects into the thread’s currentPrinciple property and into the HttpContext’s User property to accomplish your custom authentication and authorization process.

Custom ASP.NET Web API Authorization Filter

Like ASP.NET MVC, Web API also provides Authorization filter to authorize a user. This filter can be applied to an action, a controller, or even globally. This filter is based on AuthorizeAttribute class exist in System.Web.Http namespace. You can customize this filter by overriding OnAuthorization() method as shown below:

1. //custom authorize filter attribute
2. publicclassCustomAuthorizeAttribute:AuthorizeAttribute
3. {
4. privateconst string BasicAuthResponseHeader=“WWW-Authenticate”;
5. privateconst string BasicAuthResponseHeaderValue=“Basic”;
6. readonly DataContextContext=newDataContext();
7.  
8. public string UsersConfigKey{ get;set;}
9. public string RolesConfigKey{ get;set;}
10.  
11. protectedCustomPrincipalCurrentUser
12. {
13. get {returnThread.CurrentPrincipal as CustomPrincipal;}
14. set{Thread.CurrentPrincipal= value as CustomPrincipal;}
15. }
16.  
17. public override voidOnAuthorization(HttpActionContext actionContext)
18. {
19. try
20. {
21. AuthenticationHeaderValue authValue = actionContext.Request.Headers.Authorization;
22.  
23. if(authValue != null &&!String.IsNullOrWhiteSpace(authValue.Parameter)&& authValue.Scheme==BasicAuthResponseHeaderValue)
24. {
25. Credentials parsedCredentials =ParseAuthorizationHeader(authValue.Parameter);
26.  
27. if(parsedCredentials != null)
28. {
29. var user =Context.Users.Where(u => u.Username== parsedCredentials.Username&& u.Password== parsedCredentials.Password).FirstOrDefault();
30. if(user != null)
31. {
32. var roles = user.Roles.Select(m => m.RoleName).ToArray();
33. var authorizedUsers =ConfigurationManager.AppSettings[UsersConfigKey];
34. var authorizedRoles =ConfigurationManager.AppSettings[RolesConfigKey];
35.  
36. Users=String.IsNullOrEmpty(Users)? authorizedUsers :Users;
37. Roles=String.IsNullOrEmpty(Roles)? authorizedRoles :Roles;
38.  
39. CurrentUser=newCustomPrincipal(parsedCredentials.Username, roles);
40.  
41. if(!String.IsNullOrEmpty(Roles))
42. {
43. if(!CurrentUser.IsInRole(Roles))
44. {
45. actionContext.Response= actionContext.Request.CreateResponse(HttpStatusCode.Forbidden);
46. actionContext.Response.Headers.Add(BasicAuthResponseHeader,BasicAuthResponseHeaderValue);
47. return;
48. }
49. }
50.  
51. if(!String.IsNullOrEmpty(Users))
52. {
53. if(!Users.Contains(CurrentUser.UserId.ToString()))
54. {
55. actionContext.Response= actionContext.Request.CreateResponse(HttpStatusCode.Forbidden);
56. actionContext.Response.Headers.Add(BasicAuthResponseHeader,BasicAuthResponseHeaderValue);
57. return;
58. }
59. }
60.  
61. }
62. }
63. }
64. }
65. catch(Exception)
66. {
67. actionContext.Response= actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
68. actionContext.Response.Headers.Add(BasicAuthResponseHeader,BasicAuthResponseHeaderValue);
69. return;
70.  
71. }
72. }
73.  
74. privateCredentialsParseAuthorizationHeader(string authHeader)
75. {
76. string[] credentials =Encoding.ASCII.GetString(Convert.FromBase64String(authHeader)).Split(new[]{‘:’});
77.  
78. if(credentials.Length!=2|| string.IsNullOrEmpty(credentials[0])|| string.IsNullOrEmpty(credentials[1]))
79. return null;
80.  
81. returnnewCredentials(){Username= credentials[0],Password= credentials[1],};
82. }
83. }
84. //Client credential
85. publicclassCredentials
86. {
87. public string Username{ get;set;}
88. public string Password{ get;set;}
89. }

Applying CustomAuthorize attribute

To make secure your service, decorate your Web API controllers with CustomAuthorize attribute as defined above and specify the uses or roles to access specific service actions/methods. The below product service action Getproduct can be access only by Admin users.

1. publicclassProductController:ApiController
2. {
3. [CustomAuthorize(Roles=“Admin”)]
4. publicHttpResponseMessageGetproducts()
5. {
6. var products =newProduct[]
7. {
8. newProduct()
9. {
10. Id=1,
11. Name=“Soap”,
12. Price=25.12
13. },
14. newProduct()
15. {
16. Id=2,
17. Name=“Shampoo”,
18. Price=25.12
19. }
20. };
21.  
22. var response =Request.CreateResponse<ienumerable>(HttpStatusCode.OK, products);
23. <ienumerablereturn response;
24. <ienumerable}
25. <ienumerable}

Calling Web API and passing client credential from ASP.NET MVC

1. publicclassHomeController:Controller
2. {
3. //
4. // GET: /Home/
5. publicActionResultIndex()
6. {
7. string FullName=User.FirstName+” “+User.LastName;
9. HttpClient client =newHttpClient();
11. string authInfo =“admin”+“:”+“123456”;
12. authInfo =Convert.ToBase64String(Encoding.Default.GetBytes(authInfo));
13. client.DefaultRequestHeaders.Authorization=newAuthenticationHeaderValue(“Basic”, authInfo);
14.  
15. client.BaseAddress=newUri(“http://localhost:63173/&#8221;);
16.  
17. HttpResponseMessage response = client.GetAsync(“api/product/”).Result;
18. if(response.IsSuccessStatusCode)
19. {
20. // Parse the response body. Blocking!
21. var data = response.Content.ReadAsAsync<ienumerable>().Result;
22. <ienumerablereturnView();
23. <ienumerable}
24. <ienumerablereturnView();
25. <ienumerable}
26. <ienumerable}

Asp.Net Web API introduces a new powerful REST API which can be consume by a broad range of clients including browsers, mobiles, iphone and tablets. It is focused on resource based solutions and HTTP verbs.

Asp.Net Web API has a limitation while sending data to a Web API controller. In Asp.Net Web API you can pass only single complex type as a parameter. But sometimes you may need to pass multiple complex types as parameters, how to achieve this?

You can also achieve this task by wrapping your Supplier and Product classes into a wrapper class and passing this wrapper class as a parameter, but using this approach you need to make a new wrapper class for each actions which required complex types parameters. In this article, I am going to explain another simple approach using ArrayList.

Let’s see how to achieve this task. Suppose you have two classes – Supplier and Product as shown below –

1. publicclassProduct
2. {
3. publicintProductId{ get;set;}
4. public string Name{ get;set;}
5. public string Category{ get;set;}
6. public decimal Price{ get;set;}
7. }
8.  
9. publicclassSupplier
10. {
11. publicintSupplierId{ get;set;}
12. public string Name{ get;set;}
13. public string Address{ get;set;}
14. }

In your Asp.Net MVC controller you are calling your Web API and you need to pass both the classes objects to your Web API controller.

Method 1 : Using ArrayList

For passing multiple complex types to your Web API controller, add your complex types to ArrayList and pass it to your Web API actions as given below-

1. publicclassHomeController:Controller
2. {
3. publicActionResultIndex()
4. {
5. HttpClient client =newHttpClient();
6. Uri baseAddress =newUri(“http://localhost:2939/&#8221;);
7. client.BaseAddress= baseAddress;
9. ArrayList paramList =newArrayList();
10. Product product =newProduct{ProductId=1,Name=“Book”,Price=500,Category=“Soap”};
11. Supplier supplier =newSupplier{SupplierId=1,Name=“AK Singh”,Address=“Delhi”};
12. paramList.Add(product);
13. paramList.Add(supplier);
15. HttpResponseMessage response = client.PostAsJsonAsync(“api/product/SupplierAndProduct”, paramList).Result;
16. if(response.IsSuccessStatusCode)
17. {
18. returnView();
19. }
20. else
21. {
22. returnRedirectToAction(“About”);
23. }
24. }
25. publicActionResultAbout()
26. {
27. returnView();
28. }
29. }

Now, on Web API controller side, you will get your complex types as shown below.

Now deserialize your complex types one by one from ArrayList as given below-

1. publicclassProductController:ApiController
2. {
3. [ActionName(“SupplierAndProduct”)]
4. [HttpPost]
5. publicHttpResponseMessageSuppProduct(ArrayList paramList)
6. {
7. if(paramList.Count>0)
8. {
9. Product product =Newtonsoft.Json.JsonConvert.DeserializeObject(paramList[0].ToString());
10. Supplier supplier =Newtonsoft.Json.JsonConvert.DeserializeObject(paramList[1].ToString());
12. //TO DO: Your implementation code
14. HttpResponseMessage response =newHttpResponseMessage{StatusCode=HttpStatusCode.Created};
15. return response;
16. }
17. else
18. {
19. HttpResponseMessage response =newHttpResponseMessage{StatusCode=HttpStatusCode.InternalServerError};
20. return response;
21. }
22. }
23. }

Method 2 : Using Newtonsoft JArray

For passing multiple complex types to your Web API controller, you can also add your complex types to JArray and pass it to your Web API actions as given below-

1. publicclassHomeController:Controller
2. {
3. publicActionResultIndex()
4. {
5. HttpClient client =newHttpClient();
6. Uri baseAddress =newUri(“http://localhost:2939/&#8221;);
7. client.BaseAddress= baseAddress;
9. JArray paramList =newJArray();
10. Product product =newProduct{ProductId=1,Name=“Book”,Price=500,Category=“Soap”};
11. Supplier supplier =newSupplier{SupplierId=1,Name=“AK Singh”,Address=“Delhi”};
13. paramList.Add(JsonConvert.SerializeObject(product));
14. paramList.Add(JsonConvert.SerializeObject(supplier));
16. HttpResponseMessage response = client.PostAsJsonAsync(“api/product/SupplierAndProduct”, paramList).Result;
17. if(response.IsSuccessStatusCode)
18. {
19. returnView();
20. }
21. else
22. {
23. returnRedirectToAction(“About”);
24. }
25. }
26. publicActionResultAbout()
27. {
28. returnView();
29. }
30. }

Note

Don’t forget to add reference of Newtonsoft.Json.dll to your ASP.NET MVC project and WebAPI as well.

Now, on Web API controller side, you will get your complex types within JArray as shown below.

Now deserialize your complex types one by one from JArray as given below-

1. publicclassProductController:ApiController
2. {
3. [ActionName(“SupplierAndProduct”)]
4. [HttpPost]
5. publicHttpResponseMessageSuppProduct(JArray paramList)
6. {
7. if(paramList.Count>0)
8. {
9. Product product =JsonConvert.DeserializeObject(paramList[0].ToString());
10. Supplier supplier =JsonConvert.DeserializeObject(paramList[1].ToString());
12. //TO DO: Your implementation code
14. HttpResponseMessage response =newHttpResponseMessage{StatusCode=HttpStatusCode.Created};
15. return response;
16. }
17. else
18. {
19. HttpResponseMessage response =newHttpResponseMessage{StatusCode=HttpStatusCode.InternalServerError};
20. return response;
21. }
22. }
23. }

In this way, you can easily pass your complex types to your Web API. There are two solution, there may be another one as well.

As you know, Routing is a pattern matching system that monitor the incoming request and figure out what to do with that request. A URL pattern is matched against the routes patterns defined in the Route dictionary in an Order and the first match wins. This means the first route which successfully matches a controller, action, and action parameters defined in the URL will call into the specified controller and action.

Asp.Net MVC application and Asp.Net Web API must have at least one route defined in order to function. Hence, Visual Studio templates defined for MVC and Web API must have a default route. Now let’s understand the difference between Asp.Net MVC and Asp.Net Web API.

Default Route Pattern

The default route pattern for a Web API Project is defined as follows-

1. config.Routes.MapHttpRoute(
2. name:“DefaultApi”,//route name
3. routeTemplate:“api/{controller}/{id}”,//route pattern
4. defaults:new{ id =RouteParameter.Optional}//parameter default values
5. );

The literal api at the beginning of the Web API route pattern, makes it distinct from the standard MVC route. This is not mandatory but it is a good convention to differ Web API route from MVC route.

In Web API route pattern {action} parameter is optional but you can include an {action} parameter. Also, the action methods defined on the controller must be have an HTTP action verb as a prefix to the method name in order to work. So, you can also define the route for Web API as follows-

1. config.Routes.MapHttpRoute(
2. name:“DefaultApi”,//route name
3. routeTemplate:“api/{controller}/{action}/{id}”,//route pattern
4. defaults:new{ id =RouteParameter.Optional}//parameter default values
5. );

The default route pattern for an Asp.Net MVC Project is defined as follows-

1. routes.MapRoute(
2. name:“Default”,//route name
3. url:“{controller}/{action}/{id}”,//route pattern
4. defaults:new
5. {
6. controller =“Home”,
7. action =“Index”,
8. id =UrlParameter.Optional
9. }//parameter default values
10. );

As you have seen there is no literal before at the beginning of the Asp.Net MVC route pattern but you can add if you wish.

Route Processing

In Web API route processing the URLs map to a controller, and then to the action which matches the HTTP verb of the request and the most parameters of the request is selected. The Action methods defined in the API controller must either have the HTTP action verbs (GET, POST, PUT, DELETE) or have one of the HTTP action verbs as a prefix for the Actions methods name as given below-

1. publicclassValuesController:ApiController
2. {
3. // GET api/
4. publicIEnumerableGet()
5. {
6. returnnew string[]{“value1”,“value2”};
7. }
9. // GET api//5
10. public string Get(int id)
11. {
12. return“value”;
13. }
15. // POST api/
16. publicvoidPost([FromBody]string value)
17. {
18. }
20. // PUT api//5
21. publicvoidPut(int id,[FromBody]string value)
22. {
23. }
25. // DELETE api//5
26. publicvoidDelete(int id)
27. {
28. }
29. }
31. // OR You can also defined above API Controller as Verb Prefix
33. publicclassValuesController:ApiController
34. {
35. // GET api/values
36. publicIEnumerableGetValues()
37. {
38. returnnew string[]{“value1”,“value2”};
39. }
40. // GET api/values/5
41. public string GetValues(int id)
42. {
43. return“value”;
44. }
45. // POST api/values
46. publicvoidPostValues([FromBody]string value)
47. {
48. }
49. // PUT api/values/5
50. publicvoidPutValues(int id,[FromBody]string value)
51. {
52. }
53. // DELETE api/values/5
54. publicvoidDeleteValues(int id)
55. {
56. }
57. }

In Asp.Net MVC route processing the URLs map to a controller, and then to the action which matches the HTTP verb of the request and the most parameters of the request is selected. The Action methods defined in the MVC controller do not have HTTP action verbs as a prefix for the Actions methods but they have name like as normal method as shown below-

1. publicclassHomeController:Controller
2. {
3. // GET: /Home/Index
4. publicActionResultIndex()//method – Index
5. {
6. // To Do:
7. returnView();
8. }
9.  
10. // Post: /Home/Index
11. [HttpPost]
12. publicActionResultIndex(LoginModel model, string id)
13. {
14. // To Do:
15. returnView();
16. }
17. }

In MVC, by default HTTP verb is GET for using others HTTP verbs you need defined as an attribute but in Web API you need to define as an method’s name prefix.

Complex Parameter Processing

Unlike MVC, URLs in Web API cannot contain complex types. Complex types must be placed in the HTTP message body and there should be only one complex type in the body of an HTTP message.

Base Library

Web API controllers inherit from System.Web.Http.Controller, but MVC controllers inherit fromSystem.Web.Mvc.Controller. Both the library are different but acts in similar fashion.

ASP.NET Web API is one of the most powerful recent addition to ASP.NET framework. Sometimes, you have to post a form data using jQuery-JSON to Web API or MVC method, which have so many input fields. Passing each and every input field data as a separate parameter is not good practice, even when you have a strongly typed-view. The best practice is, pass a complex type object for all the input fields to the server side to remove complexity.

In this article, I am going to explain you how can you pass complex types object to the Web API and MVC method to remove complexity at server side and make it simple and useful.

Model Classes

Suppose you have the following Product class and repository for product.

1. publicclassProduct
2. {
3. publicintId{ get;set;}
4. public string Name{ get;set;}
5. public string Category{ get;set;}
6. public decimal Price{ get;set;}
7. }
8.  
9. interface IProductRepository
10. {
11. ProductAdd(Product item);
12. //To Do : Some Stuff
13. }
14.  
15. publicclassProductRepository:IProductRepository
16. {
17. privateList<Product> products =newList<Product>();
18. privateint _nextId =1;
19.  
20. publicProductRepository()
21. {
22. // Add products for the Demonstration
23. Add(newProduct{Name=“Computer”,Category=“Electronics”,Price=23.54M});
24. Add(newProduct{Name=“Laptop”,Category=“Electronics”,Price=33.75M});
25. Add(newProduct{Name=“iPhone4”,Category=“Phone”,Price=16.99M});
26. }
27.  
28. publicProductAdd(Product item)
29. {
30. if(item == null)
31. {
32. thrownewArgumentNullException(“item”);
33. }
35. // TO DO : Code to save record into database
36. item.Id= _nextId++;
37. products.Add(item);
38.  
39. return item;
40. }
41. //To Do : Some Stuff
42. }

View (Product.cshtml)

1. <scripttype=“text/javascript”>
2. //Add New Item by Web API
3. $(“#Save”).click(function(){
4.  
5. //Making complex type object
6. varProduct={
7. Id:“0”,
8. Name: $(“#Name”).val(),
9. Price: $(“#Price”).val(),
10. Category: $(“#Category”).val()
11. };
13. if(Product.Name!=“”&&Product.Price!=“”&&Product.Category!=“”){
14. //Convert javascript object to JSON object
15. var DTO = JSON.stringify(Product);
16. $.ajax({
17. url:‘api/product’,//calling Web API controller product
18. cache:false,
19. type:‘POST’,
20. contentType:‘application/json; charset=utf-8’,
21. data: DTO,
22. dataType:“json”,
23. success:function(data){
24. alert(‘added’);
25. }
26. }).fail(
27. function(xhr, textStatus, err){
28. alert(err);
29. });
30.  
31. }
32. else{
33. alert(‘Please Enter All the Values !!’);
34. }
35.  
36. });
37.  
38. </script>
39. <div>
40. <div>
41. <h2>Add New Product</h2>
42. </div>
43. <div>
44. <labelfor=“name”>Name</label>
45. <inputtype=“text”id=“Name”title=“Name”/>
46. </div>
47.  
48. <div>
49. <labelfor=“category”>Category</label>
50. <inputtype=“text”id=“Category”title=“Category”/>
51. </div>
52.  
53. <div>
54. <labelfor=“price”>Price</label>
55. <inputtype=“text”id=“Price”title=“Price”/>
56. </div>
57. <br/>
58. <div>
59. <buttonid=“Save”>Save</button>
60. <buttonid=“Reset”>Reset</button>
61. </div>
62. </div>

Web API Controller

1. publicclassProductController:ApiController
2. {
3. static readonly IProductRepository repository =newProductRepository();
4. publicProductPostProduct(Product item)
5. {
6. return repository.Add(item);
7. }
8. }

How it work ?

The same thing you have to done with MVC while calling MVC controller method using jQuery-JSON.

While developing your web application using MVC, many developers got confused when to use Web API, since MVC framework can also return JSON data by using JsonResult and can also handle simple AJAX requests. In previous article, I have explained the Difference between WCF and Web API and WCF REST and Web Service and when to use Web API over others services. In this article, you will learn when to use Web API with MVC.

Asp.Net Web API VS Asp.Net MVC

1. Asp.Net MVC is used to create web applications that returns both views and data but Asp.Net Web API is used to create full blown HTTP services with easy and simple way that returns only data not view.
2. Web API helps to build REST-ful services over the .NET Framework and it also support content-negotiation(it’s about deciding the best response format data that could be acceptable by the client. it could be JSON,XML,ATOM or other formatted data), self hosting which are not in MVC.
3. Web API also takes care of returning data in particular format like JSON,XML or any other based upon the Accept header in the request and you don’t worry about that. MVC only return data in JSON format using JsonResult.
4. In Web API the request are mapped to the actions based on HTTP verbs but in MVC it is mapped to actions name.
5. Asp.Net Web API is new framework and part of the core ASP.NET framework. The model binding, filters, routing and others MVC features exist in Web API are different from MVC and exists in the new System.Web.Http assembly. In MVC, these featues exist with in System.Web.Mvc. Hence Web API can also be used with Asp.Net and as a stand alone service layer.
6. You can mix Web API and MVC controller in a single project to handle advanced AJAX requests which may return data in JSON, XML or any others format and building a full blown HTTP service. Typically, this will be called Web API self hosting.
7. When you have mixed MVC and Web API controller and you want to implement the authorization then you have to create two filters one for MVC and another for Web API since boths are different.
8. Moreover, Web API is light weight architecture and except the web application it can also be used with smart phone apps.

Asp.Net Web API is a framework for building HTTP services that can be consume by a broad range of clients including browsers, mobiles, iphone and tablets. It is very similar to ASP.NET MVC since it contains the MVC features such as routing, controllers, action results, filter, model binders, IOC container or dependency injection. But it is not a part of the MVC Framework. It is a part of the core ASP.NET platform and can be used with MVC and other types of Web applications like Asp.Net WebForms. It can also be used as an stand-alone Web services application.

Why Asp.Net Web API (Web API) ?

Today, a web-based application is not enough to reach it’s customers. People are very smart, they are using iphone, mobile, tablets etc. devices in its daily life. These devices also have a lot of apps for making the life easy. Actually, we are moving from the web towards apps world.

So, if you like to expose your service data to the browsers and as well as all these modern devices apps in fast and simple way, you should have an API which is compatible with browsers and all these devices.

For example twitter,facebook and Google API for the web application and phone apps.

Web API is the great framework for exposing your data and service to different-different devices. Moreover Web API is open source an ideal platform for building REST-ful services over the .NET Framework. Unlike WCF Rest service, it use the full featues of HTTP (like URIs, request/response headers, caching, versioning, various content formats) and you don’t need to define any extra config settings for different devices unlike WCF Rest service.

Web API Features

1. It supports convention-based CRUD Actions since it works with HTTP verbs GET,POST,PUT and DELETE.
2. Responses have an Accept header and HTTP status code.
3. Responses are formatted by Web API’s MediaTypeFormatter into JSON, XML or whatever format you want to add as a MediaTypeFormatter.
4. It may accepts and generates the content which may not be object oriented like images, PDF files etc.
5. It has automatic support for OData. Hence by placing the new [Queryable] attribute on a controller method that returns IQueryable, clients can use the method for OData query composition.
6. It can be hosted with in the applicaion or on IIS.
7. It also supports the MVC features such as routing, controllers, action results, filter, model binders, IOC container or dependency injection that makes it more simple and robust.

Why to choose Web API ?

1. If we need a Web Service and don’t need SOAP, then ASP.Net Web API is best choice.
2. It is Used to build simple, non-SOAP-based HTTP Services on top of existing WCF message pipeline.
3. It doesn’t have tedious and extensive configuration like WCF REST service.
4. Simple service creation with Web API. With WCF REST Services, service creation is difficult.
5. It is only based on HTTP and easy to define, expose and consume in a REST-ful way.
6. It is light weight architecture and good for devices which have limited bandwidth like smart phones.
7. It is open source.