Click here to Skip to main content
Click here to Skip to main content

Secure WCF RESTful service using OAUTH

, 24 Apr 2012 CPOL
Rate this:
Please Sign up or sign in to vote.
How to build a security layer on top of your WCF RESTful service.

Introduction

To get started with this article, we will build a WCF RESTful service which is called the service provider and client application (in this case it's a web app) which would use services and is called the consumer. I wanted to build a security layer on top of my WCF RESTful service. So when I Googled I got many links targeting at OAUTH and all the articles and posts talking about using OAUTH with complicated examples. I could not figure out where to start.

After many clicks on Google, I found pieces of code to understand what needed to be done to provide security for my RESTful services. So in this article I will try to keep things as simple as possible and show how to achieve this complicated task.

So what is OAUTH?

OAuth is a standardization and combined wisdom of many well established industry protocols. It is similar to other protocols currently in use (Google AuthSub, AOL OpenAuth, Yahoo! BBAuth, Upcoming API, Flickr API, Amazon Web Services API, etc.).

DotNetOpenAuth is a consumer and service provider implementation for OAuth 1.0 and 1.0a for .NET, written in C#. It has built-in support for HMAC-SHA1, RSA-SHA1, and PLAINTEXT signature methods with extensibility to add others.

Many people have contributed towards OAUTH implementation for Java, .NET, PERL, PHP, etc. DevDefined OAuth has contributed for .NET. Before we start on an example, download the base class from https://oauth.googlecode.com/svn/code/csharp/OAuthBase.cs.

Now let’s get on to the code part. In this article I will not discuss how to build a RESTful service from scratch.

In my WCF RESTful service I have implemented a Get method (GetSampleMethod_Without_OAuth) without using OAUTH. Below is the simple implementation (hoping it is quite simple Smile | :) )

[OperationContract(Name = "GetSampleMethod_Without_OAuth")]
[WebGet(UriTemplate = "GetSampleMethod_Without_OAuth/inputStr/{name}")]
string GetSampleMethod_Without_OAuth(string name);
public string GetSampleMethod_Without_OAuth(string strUserName)
{
    StringBuilder strReturnValue = new StringBuilder();
    // return username prefixed as shown below
    strReturnValue.Append(string.Format("You have entered userName as {0}", strUserName));
    return strReturnValue.ToString();
}

To verify this method, open the browser with the URL: https://localhost/MyService.svc/GetSampleMethod_Without_OAuth/inputStr/suryaprakash.

In this case you would see the output and if you notice, this service is wide open to anyone. To overcome such issues we could go with the below implementation.

Let’s implement another method with OAuth security. This method would return the same output as above but before processing, it would check for CONSUMERSECRET which is supposed to be sent from the client to make use of the services. If the key doesn’t match it would return an unauthorized request message.

This consumer secret can be shared with multiple clients. Apart from the consumer secret there are parameters like oauth_timestamp, oauth_nonce, URL, etc., which are to be sent (more details on https://oauth.net/code/).

In my case the consumer secret is “suryabhai” which has to be sent along with the service call. The authenticate method would read all input parameters and send it to the OAuthBase class, and finally it would return true or false which will define whether to process the request or deny it.

Let's look at the below code:

[OperationContract(Name = "GetSampleMethod_With_OAuth")]
[WebGet(UriTemplate = "GetSampleMethod_With_OAuth/inputStr/{name}")]
string GetSampleMethod_With_OAuth(string name);
public string GetSampleMethod_With_OAuth(string strUserName)
{
    if (Authenticate(WebOperationContext.Current.IncomingRequest))
    {
        StringBuilder strReturnValue = new StringBuilder();
        // return username prefixed as shown below
        strReturnValue.Append(string.Format("You have entered userName as {0}", strUserName));
        return strReturnValue.ToString();
    }
    else
    {
        WebOperationContext.Current.OutgoingResponse.StatusCode = HttpStatusCode.Unauthorized;
        return "Unauthorized Request.";
    }
}

private static bool Authenticate(IncomingWebRequestContext context)
{
    bool Authenticated = false;
    string normalizedUrl;
    string normalizedRequestParameters;
    //context.Headers
    NameValueCollection pa = context.UriTemplateMatch.QueryParameters;
    if (pa != null && pa["oauth_consumer_key"] != null)
    {
        // to get uri without oauth parameters
        string uri = context.UriTemplateMatch.RequestUri.OriginalString.Replace
            (context.UriTemplateMatch.RequestUri.Query, "");
        string consumersecret = "suryabhai";
        OAuthBase oauth = new OAuthBase();
        string hash = oauth.GenerateSignature(
            new Uri(uri),
            pa["oauth_consumer_key"],
            consumersecret,
            null, // totken
            null, //token secret
            "GET",
            pa["oauth_timestamp"],
            pa["oauth_nonce"],
            out normalizedUrl,
            out normalizedRequestParameters
            );
        Authenticated = pa["oauth_signature"] == hash;
    }
    return Authenticated;
}

So far so good, the implementation is done, now let's open the browser and call the service: https://localhost/MyService.svc/GetSampleMethod_With_OAuth/inputStr/suryaprakash.

When you make a request to the GetSampleMethod_With_OAuth method as above, the service would return “UNAUTHORIZED REQUEST” as we did not supply the consumer secret and other parameters. To complete this article, let’s go ahead and implement a client which will call the above method by sending all the necessary inputs/parameters.

As part of the client implementation, we would make a call to the service using a WebRequest by providing all the necessary parameters and the client code has to use the same consumer secret shared by the service.

In the default.aspx.cs PageLoad event, add the below code. The client also has to include the OAuthBase class from https://oauth.googlecode.com/svn/code/csharp/OAuthBase.cs.

string consumerKey = "test";
string consumerSecret = "suryabhai";
var uri = new Uri("http://localhost/MyService.svc/GetSampleMethod_With_OAuth/inputStr/suryaprakash");
string url, param;
var oAuth = new OAuthBase();
var nonce = oAuth.GenerateNonce();
var timeStamp = oAuth.GenerateTimeStamp();
var signature = oAuth.GenerateSignature(uri, consumerKey,
consumerSecret, string.Empty, string.Empty, "GET", timeStamp, nonce,
OAuthBase.SignatureTypes.HMACSHA1, out url, out param);
WebResponse webrespon = (WebResponse)WebRequest.Create(
   string.Format("{0}?{1}&oauth_signature={2}", url, param, signature)).GetResponse();
StreamReader stream =new StreamReader(webrespon.GetResponseStream());
txtResult.Text = stream.ReadToEnd();

Now let’s call the service by opening the default.aspx page in browser. As we are using a valid consumer secret, the output would be as expected. Now let’s modify the consumer secret and open default.aspx. In this case the expected output is “UNAUTIRUZED REQUEST”.

My example talks about only the GET method and sending data in a query string but it can be extended for a POST method as well and we can send data in headers instead of the query string.

Happy coding… Hope this helps!

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Bangla Gopal Surya Prakash
Software Developer (Senior)
United States United States
B.Tech graduate in CSE, having experience in .Net related Technologies
 
Microsoft Certified Technical Specialist in .NET Framework 2.0
Microsoft Certified Technical Specialist in .NET Framework 4.0
 
My interests are Coding, reading [technical stuff] and listening to music, playing Cricket, Table Tennis
 
http://bgsuryablog.blogspot.com/

Comments and Discussions

 
QuestionGreat tutorial !!! PinmemberMinh Chien Nguyen Jul9-Oct-12 21:56 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Mobile
Web01 | 2.8.141015.1 | Last Updated 24 Apr 2012
Article Copyright 2012 by Bangla Gopal Surya Prakash
Everything else Copyright © CodeProject, 1999-2014
Terms of Service
Layout: fixed | fluid