Pass auth token to wcf one time

Question

I just started to work on wcf service build an web application to consume my service . I made that token based i pass token in every request and then check that token on each request from database that its valid or not . I think this is not good to send an extra request to db every time . So , is this possible to authenticate user first time when he login or first make request to service and after that until session remain all my requests work with token ?

I searched on google but every one was telling how to authenticate with service .

What kind of token do you pass to the service? – Jan Köhler Dec 28 '14 at 18:40 — Jan Köhler, Dec 28 '14 at 18:40
its just a random string generated when on user creation – Ancient Dec 28 '14 at 19:15 — Ancient, Dec 28 '14 at 19:15

Wiktor Zychla · Answer 1 · 2014-12-29T22:41:53.520

0

Instead of a random string that you generate and need to check in the database, make your tokens around encryption and/or signing just like many authentication modules do.

In other words, build a token from a user/application name, issue date and/or expiry date, encrypt it and you have a self-contained token that doesn't need any database lookups for validation.

For easy encryption, the MachineKey can be used

http://msdn.microsoft.com/en-us/library/system.web.security.machinekey%28v=vs.110%29.aspx

A side note - this is how forms authentication / session authentication modules work. You have cookies (tokens) that carry the authentication information. You could consider switching to these.

Edit: an example you ask about:

// create token
string username = "foo";
string token = Convert.ToBase64String( MachineKey.Protect( 
                  Encoding.UTF8.GetBytes( username ) ) );

// get username out of token
string token = ....;
string username = Encoding.UTF8.GetString( MachineKey.Unprotect( 
                  Convert.FromBase64String( token ) ) );

edited Dec 29 '14 at 22:41

answered Dec 29 '14 at 17:24

Wiktor Zychla

47,367
6
74
106

can you put an example , i didn't understand – Ancient Dec 29 '14 at 18:27
I edited my answer with a basic example that should give you an idea on how to design your own tokens. – Wiktor Zychla Dec 29 '14 at 22:42
and do what after getting out token how can i verify that this is a real client that needs to consume my service , even in this situation i need to call database . So what to do can you please explain – Ancient Dec 30 '14 at 07:35
i have many client who will consume my service and every client will have different tokens , so how to get know which client is calling and whether a client is calling or its a fake – Ancient Dec 30 '14 at 07:36
Since tokens are encrypted at the server, there is really no way to forge them client-side. – Wiktor Zychla Dec 30 '14 at 08:35

score 0 · Answer 2 · edited May 23 '17 at 12:20

Checking the Auth token with the database on each request is probably a bad idea. What is commonly used as a token is the current user principal itself but serialized and encrypted. The token is generated and returned to the client upon login. Then on each request you pass the token the service which then gives you the opportunity to deserialize it and populate your System.Threading.Thread.CurrentPrincipal without a roundtrip to the DB.

Check these SO answers for more insight

Pass auth token to wcf one time

2 Answers2