Geek asks and answers

RESTful Password Verification Service

I am writing a Verify Password service using ASP.NET Web Api.

The service accepts the password for the current user, which verifies it, validates and returns the encoded value. All this happens through SSL.

Calling this method does not lead to state changes.

Initially, this looks like a request GET, but upon further verification, I worry about the web server registering plain text passwords.

We could implement this as POST, but it looks like an irregular verb given by an action.

Is it just a case of pragmatism over a procedure, or are there more possibilities for performing both pragmatic and RESTful cases?

+5
source share
2

, / . , .

javascript base64 - .

, (cookie), OAuth 2.0.

+1

API , ( , ), .

UserPasswordsController, , :

[HttpPost()] 
public HttpResponseMessage Validate()
{
    if (!this.Request.Content.IsFormUrlEncodedContent())
    {
        return this.Request.CreateErrorResponse(
            HttpStatusCode.BadRequest, 
            "Body of request must be form URL encoded."
        );
    }

    var parameters  = this.Request.Content.ReadAsFormDataAsync().Result;

    var userName    = parameters["userName"];
    var password    = parameters["password"];

    // TODO: Validate user name and password
    var isValid = true;

    if(!isValid)
    {
        return this.Request.CreateErrorResponse(
            HttpStatusCode.Forbidden, 
            String.Format(null, "The password provided for {0} is not valid.", userName)
        );
    }

    return this.Request.CreateResponse(HttpStatusCode.OK);
}

:

routes.MapHttpRoute(
    name:           "UserPasswords",
    routeTemplate:  "api/v1/validate",
    defaults:       new { controller = "userpasswords" }
);

POST , , . , , OK , .

REST , Web API Design - , .

0

More articles:


All Articles