ASP。NET MVC RESTful身份验证API

How would I go about handling authentication in a RESTful way that will work with desktop/mobile apps? For eg. I know how to build authentication in my apps by using FormsAuthentication, which relies on cookies, which I assume only works with browsers.

如何以RESTful的方式处理身份验证，以便与桌面/移动应用程序一起工作?如。我知道如何使用FormsAuthentication在我的应用程序中构建身份验证，它依赖于cookie，我认为它只适用于浏览器。

Do I still use FormsAuthentication? My login method takes passwords and usernames, and I plan to use other 3rd party logins such as google, twitter and facebook.

我还使用FormsAuthentication吗?我的登录方法使用密码和用户名，我计划使用其他第三方登录，如谷歌，twitter和facebook。

So for the password and username, the client sends that to the server, how do I set it up so an android or windows phone 7 app can authenticate with it.

对于密码和用户名，客户端会将密码发送给服务器，我如何设置它以便android或windows phone 7应用程序可以使用它进行身份验证。

I'm also exposing some actions with the [Authorize] attribute.

我还使用[Authorize]属性公开了一些操作。

1 个解决方案

#1

Dominik Bayer did a great talk at NDC 2011 about securing rest services. He discusses pros and cons of multiple ways. A good point to start from...

Dominik Bayer在NDC 2011年做了一个关于获得rest服务的演讲。他讨论了多种方法的利弊。这是一个很好的开始。

You have to seperate Authentication and Authorization.

您必须分离身份验证和授权。

If you go with multiple Login-Provider (google, facebook, twitter) then Oauth would be the choice...

如果你使用多个登录提供者(谷歌、facebook、twitter)，那么Oauth将是你的选择……

But more details here:

但更多的细节:

Securing REST-Services and Web-APIs:

确保rest服务和web api:

http://ndc2011.macsimum.no/SAL1/Torsdag/1740-1840.wmv

http://ndc2011.macsimum.no/sal1/torsdag/1740 - 1840. wmv

#1