Authorization with OAuth Bearer Token provided by External Web API

Question

I'm posting this in the hope of receiving some feedback/advice and information on something I've been struggling with the last few days. To start I'll give a quick breakdown of the project.

There are 2 applications in the solution:

1. WebAPI resource & authorization server - Uses OWIN (hosted in IIS) and ASP.NET Identity to issue an authentication token on a correct login and then allow requests to the various controllers.

2. MVC client application - Has no authorization as of yet (until I figure it out) but will make calls to the WebAPI resource server to get all data. These calls will only ever be made from actions of the controllers in the client app, no client side AJAX calls.

The client application doesn't have it's own datasource. All information is stored in a database which the WebAPI service has access to, so essentially if they provide the correct credentials and the client app receives a bearer token I need to deliver a way for the application to see them as authorized.

• What's the best way to handle this?
• Is it possible to configure OWIN on the client side to use the OAuth settings of the server? Am I barking up the wrong tree and will I need to just use HTTPClients?
• Could I deserialize the bearer token and store it in session, and then write my own authorization providers to check these on the client side?

My initial concerns are I'm abusing Bearer Tokens and trying to cobble them into a solution which isn't ideal. All examples of external authorization I've found so far usually involve making calls to providers hosted by Google/Facebook/Twitter to check the user is who they say they are, and then moves on to creating a user record in their system. My application can't do this.

In regards to security I was planning to introduce filters which would validate the request has came from the client application by providing an identifier and secret, along with IP validation.

I realize this may be a bit open ended, but I'd appreciate any advice. The scope of the project is that the web service is the only thing to have access to the database. The MVC client application will be hosted on a different server, and the service will only accept requests from said client application.

Answer 1

You don't need to access the data source in your MVC app to validate the bearer token. Basically, you can do it in the following way,

• MVC app requests access_token from webapi and passes it to the UI client (let's say a browser).

• Browser stores the access_token in a cookie/localstorage and sends them to the MVC app for all subsequent requests.

• Create an ActionFilter in the MVC app to validate if the request from the browser has the token supplied in the header. If not, reject the request.

• MVC app passes the access_token in the Authorization header to the webapi.

• Use HTTPS for all communications (between MVC app <-> Client and MVC app <-> WebAPI)

You can further obfuscate or encrypt the access_token you get from the WebAPI on the MVC app side for additional security but then you will have to send the decrypted version back to the WebAPI.