Upshot/Knockout Architectural Best Practices - What is the preferred of method of limiting user access to functions exposed through the WebAPI?

Question

A fundamental idea in implementing a single page application with Knockout and Upshot is that most of the data will received from and sent to the server in JSON format using AJAX.

On the server, we will expose a number of endpoints (using perhaps WebAPI and the DbDataController) to respond to requests from Upshot. These endpoints may provide general queries for data such as lists of clients, previous orders, account information, etc.

Obviously, it is not desirable for one client to be able view another clients account information, previous orders, or other private data.

• What strategies or approaches be used to secure queries (and data) which are being requested from upshot (or other mechanism) to the server? (In other words, how do we make sure a user only has access to his own data?)
• Are the strategies the same or different than those used in a normal ASP.NET MVC application--namely use of the Authorize attribute?

This is probably a very simple question, but I am still not clear on all the differences between WebAPI controllers and normally ASP.NET MVC controllers.

Thank for your help!

Answer 1

A custom authorize attribute is one possible way to implement this requirement. The only difference with standard ASP.NET MVC controllers is that you derive from System.Web.Http.AuthorizeAttribute instead of System.Web.Mvc.AuthorizeAttribute.