Security/WebAPI Flashcards
Introduction to Identity
It is an API that manages users, passwords, profile data, roles, tokens, email confirmation, external logins etc.
It is by default built on top of EntityFrameworkCore; you can also create custom data stores.
**IdentityUser<T>**
Acts as a base class for ApplicationUser class that acts as model class to store user details.
You can add additional properties to the ApplicationUser class.</T>
Built-in Properties:
Id
UserName
PasswordHash
Email
PhoneNumber
**IdentityRole<T>**
Acts as a base class for ApplicationRole class that acts as model class to store role details. Eg: "admin"
You can add additional properties to the ApplicationRole class.</T>
Built-in Properties:
Id
Name
IDENTITY USER + IDENTITY ROLE
UserManager
Provides business logic methods for managing users.
It provides methods for creating, searching, updating and deleting users.
Methods:
CreateAsync()
DeleteAsync()
UpdateAsync()
IsInRoleAsync()
FindByEmailAsync()
FindByIdAsync()
FindByNameAsync()
CRUD + FIND
SignInManager
Provides business logic methods for sign-in and sign-in functionality of the users.
It provides methods for creating, searching, updating and deleting users.
Methods:
SignInAsync()
PasswordSignInAsync()
SignOutAsync()
IsSignedIn()
Areas
Area is a group of related controllers, views and models that are related to specific module or specific user.
Role Based Authentication
User-role defines type of the user that has access to specific resources of the application.
Examples: Administrator role, Customer role etc.
XSRF
XSRF (Cross Site Request Forgery - CSRF) is a process of making a request to a web server from another domain, using an existing authentication of the same web server.
Eg: attacker.com creates a form that sends malicious request to original.com.
Asp.Net Core 4 elements
Asp.Net Core MVC
Asp.Net Core Web API
Asp.Net Core Blazor
Asp.Net Core Razor Pages
Introduction to Web API
ASP.NET Core Web API is a component (part) of ASP.NET Core, which is used create HTTP-based RESTful services (also known as HTTP services) that can be consumed (invoked) by wide range of client applications such as single-page web applications, mobile applications etc.
IActionResult [vs] ActionResult
IActionResult
public interface IActionResult
{
Task ExecuteResultAsync(ActionContext context); //converts an object into response
}
ActionResult<T>
public sealed class ActionResult<T>
{
IActionResult Convert();</T></T>
// converts the object into ObjectResult
}
RESTful / Web API Services
RESTful services (Representational State Transfer) is an architecture style that defines to create HTTP services that receives HTTP GET, POST, PUT, DELETE requests; perform CRUD operations on the appropriate data source; and returns JSON / XML data as response to the client.
Web API Controllers
Should be either or both:
The class name should be suffixed with “Controller”. Eg: ProductsController
The [ApiController] attribute is applied to the same class or to its base class.
Optional:
Is a public class.
Inherited from Microsoft.AspNetCore.Mvc.ControllerBase.
Introduction to Swagger
Swagger is a set of open-source tools that help developers to generate interactive UI to document, test RESTful services.
Swagger is a set of tools to implement Open API.
- Swasbuckle.AspNetCore
Framework that makes it easy to use swagger in asp.net core. - Swagger
Set of tools to generate UI to document & test RESTful services. - Open API
Specification that defines how to write API specifications in JSON).
API Versions
API Versioning is the practice of transparently managing changes to your API, where the client requests a specific version of API; and the server executes the same version of the API code.
Content Negotiation
Content negotiation is the process of selecting the appropriate format or language of the content to be exchanged between the client (browser) and Web API.
Identity with Web API
It is an API that manages users, passwords, profile data, roles, tokens, email confirmation, external logins etc.
It is by default built on top of EntityFrameworkCore; you can also create custom data stores.
