Authentication and authorization in asp.net

Question

Hi All, Can anyone please post the detail explanation of authentication and authorization in asp.net. Types of authentication with one example Thanks, Vamsi

Sreekanth Reddy · Answer

Hi vamsi, Coming to the point of web services & web api, implementing the authentication and authorization willbe little different but the concept is same as like I said in previous reply. In web services or web api they behaves as a URL for which we needs to pass the credentials(like username & password). Based on the passed credentials we check weather the user is valid or not which is nothing but the authentication. If the user is authenticated user, our web api generates a "Token" and sends back the token to the requested user and stores in browser or any storage locations. From the next requests to another api's It checks weather the "Token" is matched or not instead of username and password. If you are interested, For mor check the below URL for "Token" generation and more. https://www.codeproject.com/Articles/1005485/RESTful-Day-sharp-Security-in-Web-APIs-Basic If it helps mark as answer. Thank you.

Vamsi k · Answer

Hi Sreekanth Thanks for your reply. What is authentication and authorization works in webservices and in webapi Can you please give explanation on that. Thanks, Vamsi

Sreekanth Reddy · Answer

Hi vamsi, Authentication : Its like checking the user is logged in or not. How & when ? Lets think about the following steps : 1)Log into your facebook account. 2)Copy the URL of your home page after logged In. 3)Now logout the facebook account. 4)Now, Paste the copied URL in the URL bar and hit enter. 5)Find out, It throws back you to login page. From the 5th step it's checking weather the user is logged in or not based on that it is navigating. This is nothing but the authentication. Authorization : Let us think that some pages in our application is designed for the admins(who can manage the users or products of web site or anything else) & some for only users who can just buy the products but not add the products. Based on the type of the user(user/admin) we are providing the access for the one who logged in. We know that we wont allow the normal user to add the products into website. only admin can.. This is nothing but the authorization. All these settingscan be done in asp.net/asp.net MVC fron the web.config file. Hope you understood a bit. If not please come back with your query. Accept the answer if it helps. Thank you.