Click here to Skip to main content
12,446,703 members (55,876 online)
Click here to Skip to main content
Add your own
alternative version

Tagged as

Stats

94.6K views
63 bookmarked
Posted

Secure WCF RESTful service using OAUTH

, 24 Apr 2012 CPOL
Rate this:
Please Sign up or sign in to vote.
How to build a security layer on top of your WCF RESTful service.

Introduction

To get started with this article, we will build a WCF RESTful service which is called the service provider and client application (in this case it's a web app) which would use services and is called the consumer. I wanted to build a security layer on top of my WCF RESTful service. So when I Googled I got many links targeting at OAUTH and all the articles and posts talking about using OAUTH with complicated examples. I could not figure out where to start.

After many clicks on Google, I found pieces of code to understand what needed to be done to provide security for my RESTful services. So in this article I will try to keep things as simple as possible and show how to achieve this complicated task.

So what is OAUTH?

OAuth is a standardization and combined wisdom of many well established industry protocols. It is similar to other protocols currently in use (Google AuthSub, AOL OpenAuth, Yahoo! BBAuth, Upcoming API, Flickr API, Amazon Web Services API, etc.).

DotNetOpenAuth is a consumer and service provider implementation for OAuth 1.0 and 1.0a for .NET, written in C#. It has built-in support for HMAC-SHA1, RSA-SHA1, and PLAINTEXT signature methods with extensibility to add others.

Many people have contributed towards OAUTH implementation for Java, .NET, PERL, PHP, etc. DevDefined OAuth has contributed for .NET. Before we start on an example, download the base class from https://oauth.googlecode.com/svn/code/csharp/OAuthBase.cs.

Now let’s get on to the code part. In this article I will not discuss how to build a RESTful service from scratch.

In my WCF RESTful service I have implemented a Get method (GetSampleMethod_Without_OAuth) without using OAUTH. Below is the simple implementation (hoping it is quite simple Smile | :) )

[OperationContract(Name = "GetSampleMethod_Without_OAuth")]
[WebGet(UriTemplate = "GetSampleMethod_Without_OAuth/inputStr/{name}")]
string GetSampleMethod_Without_OAuth(string name);
public string GetSampleMethod_Without_OAuth(string strUserName)
{
    StringBuilder strReturnValue = new StringBuilder();
    // return username prefixed as shown below
    strReturnValue.Append(string.Format("You have entered userName as {0}", strUserName));
    return strReturnValue.ToString();
}

To verify this method, open the browser with the URL: https://localhost/MyService.svc/GetSampleMethod_Without_OAuth/inputStr/suryaprakash.

In this case you would see the output and if you notice, this service is wide open to anyone. To overcome such issues we could go with the below implementation.

Let’s implement another method with OAuth security. This method would return the same output as above but before processing, it would check for CONSUMERSECRET which is supposed to be sent from the client to make use of the services. If the key doesn’t match it would return an unauthorized request message.

This consumer secret can be shared with multiple clients. Apart from the consumer secret there are parameters like oauth_timestamp, oauth_nonce, URL, etc., which are to be sent (more details on https://oauth.net/code/).

In my case the consumer secret is “suryabhai” which has to be sent along with the service call. The authenticate method would read all input parameters and send it to the OAuthBase class, and finally it would return true or false which will define whether to process the request or deny it.

Let's look at the below code:

[OperationContract(Name = "GetSampleMethod_With_OAuth")]
[WebGet(UriTemplate = "GetSampleMethod_With_OAuth/inputStr/{name}")]
string GetSampleMethod_With_OAuth(string name);
public string GetSampleMethod_With_OAuth(string strUserName)
{
    if (Authenticate(WebOperationContext.Current.IncomingRequest))
    {
        StringBuilder strReturnValue = new StringBuilder();
        // return username prefixed as shown below
        strReturnValue.Append(string.Format("You have entered userName as {0}", strUserName));
        return strReturnValue.ToString();
    }
    else
    {
        WebOperationContext.Current.OutgoingResponse.StatusCode = HttpStatusCode.Unauthorized;
        return "Unauthorized Request.";
    }
}

private static bool Authenticate(IncomingWebRequestContext context)
{
    bool Authenticated = false;
    string normalizedUrl;
    string normalizedRequestParameters;
    //context.Headers
    NameValueCollection pa = context.UriTemplateMatch.QueryParameters;
    if (pa != null && pa["oauth_consumer_key"] != null)
    {
        // to get uri without oauth parameters
        string uri = context.UriTemplateMatch.RequestUri.OriginalString.Replace
            (context.UriTemplateMatch.RequestUri.Query, "");
        string consumersecret = "suryabhai";
        OAuthBase oauth = new OAuthBase();
        string hash = oauth.GenerateSignature(
            new Uri(uri),
            pa["oauth_consumer_key"],
            consumersecret,
            null, // totken
            null, //token secret
            "GET",
            pa["oauth_timestamp"],
            pa["oauth_nonce"],
            out normalizedUrl,
            out normalizedRequestParameters
            );
        Authenticated = pa["oauth_signature"] == hash;
    }
    return Authenticated;
}

So far so good, the implementation is done, now let's open the browser and call the service: https://localhost/MyService.svc/GetSampleMethod_With_OAuth/inputStr/suryaprakash.

When you make a request to the GetSampleMethod_With_OAuth method as above, the service would return “UNAUTHORIZED REQUEST” as we did not supply the consumer secret and other parameters. To complete this article, let’s go ahead and implement a client which will call the above method by sending all the necessary inputs/parameters.

As part of the client implementation, we would make a call to the service using a WebRequest by providing all the necessary parameters and the client code has to use the same consumer secret shared by the service.

In the default.aspx.cs PageLoad event, add the below code. The client also has to include the OAuthBase class from https://oauth.googlecode.com/svn/code/csharp/OAuthBase.cs.

string consumerKey = "test";
string consumerSecret = "suryabhai";
var uri = new Uri("http://localhost/MyService.svc/GetSampleMethod_With_OAuth/inputStr/suryaprakash");
string url, param;
var oAuth = new OAuthBase();
var nonce = oAuth.GenerateNonce();
var timeStamp = oAuth.GenerateTimeStamp();
var signature = oAuth.GenerateSignature(uri, consumerKey,
consumerSecret, string.Empty, string.Empty, "GET", timeStamp, nonce,
OAuthBase.SignatureTypes.HMACSHA1, out url, out param);
WebResponse webrespon = (WebResponse)WebRequest.Create(
   string.Format("{0}?{1}&oauth_signature={2}", url, param, signature)).GetResponse();
StreamReader stream =new StreamReader(webrespon.GetResponseStream());
txtResult.Text = stream.ReadToEnd();

Now let’s call the service by opening the default.aspx page in browser. As we are using a valid consumer secret, the output would be as expected. Now let’s modify the consumer secret and open default.aspx. In this case the expected output is “UNAUTIRUZED REQUEST”.

My example talks about only the GET method and sending data in a query string but it can be extended for a POST method as well and we can send data in headers instead of the query string.

Happy coding… Hope this helps!

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author


You may also be interested in...

Pro
Pro

Comments and Discussions

 
Questionsecurity of oauth parameters on cosumer side Pin
bhupinder719-Mar-13 7:32
memberbhupinder719-Mar-13 7:32 
QuestionSend POST request Pin
pankaj.thadani24-Feb-13 20:51
memberpankaj.thadani24-Feb-13 20:51 
QuestionUnAuthorized User Pin
zubreha8-Jan-13 8:24
memberzubreha8-Jan-13 8:24 
SuggestionGood overview... Pin
Haukur Kristinsson6-Dec-12 14:07
memberHaukur Kristinsson6-Dec-12 14:07 
QuestionGreat tutorial !!! Pin
Minh Chien Nguyen Jul9-Oct-12 21:56
memberMinh Chien Nguyen Jul9-Oct-12 21:56 
QuestionIs it possible to use HTML instaed of aspx ? Pin
MaheswarSPillai10-Sep-12 19:21
memberMaheswarSPillai10-Sep-12 19:21 
AnswerRe: Is it possible to use HTML instaed of aspx ? Pin
Firnas20-May-13 19:40
memberFirnas20-May-13 19:40 
QuestionRepeated requests are unauthorized Pin
mdgardipee13-Aug-12 3:34
membermdgardipee13-Aug-12 3:34 
Great example - I tested everything in this article in about 15 minutes - so it was very concise and clear. I have 2 questions, though the main has to do with Authentication failures on subsequent calls. I implemented this in a button handler so I could test it repeatedly. What I find is that the first time, I am authenticated as expected. Any (or most) subsequent requests, or even between debug sessions - it returns "The remote server returned an error: (401) Unauthorized." I am interested in getting some feedback on this, though in the meantime I am going to look at whether the nonce is not changing or if other parts of the authentication are the cause.

The other question revolves deplyoying 1 service that can support multiple 'consumer keys' and multiple 'Consumer secrets'. Programatically, I can implement it. What I am interested in is whether there is a 'Best Pratice' when implementing this.

Thanks in advance,
Michael Gardipee
AnswerRe: Repeated requests are unauthorized Pin
zubreha8-Jan-13 8:21
memberzubreha8-Jan-13 8:21 
AnswerRe: Repeated requests are unauthorized Pin
nrpl0318-Jan-13 3:52
membernrpl0318-Jan-13 3:52 
Generalnice article for beginner Pin
vyas_pratik204-Jun-12 2:54
membervyas_pratik204-Jun-12 2:54 
GeneralMy vote of 5 Pin
Balakrishnan Dhinakaran21-May-12 19:14
memberBalakrishnan Dhinakaran21-May-12 19:14 
QuestionFantastic! But what about JQuery Clients? Pin
quicoli25-Apr-12 2:50
memberquicoli25-Apr-12 2:50 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web02 | 2.8.160811.3 | Last Updated 24 Apr 2012
Article Copyright 2012 by Bangla Gopal Surya Prakash
Everything else Copyright © CodeProject, 1999-2016
Layout: fixed | fluid