Retrieve bearer token in ASP.NET WebAPI

c# asp.net-web-api bearer-token
SzilardD picture SzilardD · Sep 10, 2014 · Viewed 8.9k times · Source

I have a Web API with authentication enabled (bearer token). This is called by a client application and I want to protect it from anonymous usage so I would like to create a single user and create a bearer token for it.

I can create the token by calling the register and token methods, but I would like to do this from code.

  1. As far as I know, the bearer token is not stored in the database. Can it be retrieved somehow using the ASP.NET Identity API?

  2. I would also like to create this user from code and save the token somewhere because I need to deploy the database to multiple servers.

Answer

Taiseer Joudeh picture Taiseer Joudeh · Sep 12, 2014

I do not recommend going with this approach if you have only one client who will talk to your API, my understanding that you need to issue a very very long lived access token maybe for a year and keep using this token to access the back-end API, right? What you will do if this token is stolen? You can't revoke the access token, so it is somehow like your master key (password). My recommendation is to use OAuth refresh tokens along with access tokens. This depends on the type of your client, you can check how this is done here http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/ The refresh tokens can be revoked and they can expire after a very long time. Let me know if you need further details to implement this.

Related questions

Adding additional logic to Bearer authorization

I am attempting to implement OWIN bearer token authorization, and based on this article. However, there's one additional piece of information I need in bearer token that I don't know how to implement. In my application, I need to deduce …

Read More
Manually decode OAuth bearer token in c#

In my Web Api 2.2 OWIN based application I have a situation where I manually need to decode the bearer token but I don't know how to do this. This is my startup.cs public class Startup { public static OAuthAuthorizationServerOptions OAuthServerOptions { …

Read More
How to get error message returned by DotNetOpenAuth.OAuth2 on client side?

I'm using ExchangeUserCredentialForToken function to get the token from the Authorization server. It's working fine when my user exists in my databas, but when the credentials are incorect I would like to send back a message to the client. I'm …

Read More