MVC 4 Web Api Security

Question

I am very new in web api security. I have used form authentication technique. when user logs in, a token is created and stored as a cookie in user's web browser. On each request the token is varified and if user is authenticated and authorized user is given access to the service.

but I think this approach does nothing in web api security. cookies can easily be copied and pasted in other browser and anyone can get the service.

I am thinking to use App key and secret along with form authentication. I am not suggested to use third party service like Oauth for authentication. I am not Sure about the Implementation of app key and secret that how it exactly works.

Please provide better way to secure my web api wihtout using third party services and to prevent cookie hijacking etc. What actions are performed to build a strengthly secure web api.

Felt

"cookies can easily be copied and pasted in other browser and anyone can get the service." - this does require a logged in account though. – Narrow

How will you know that the authentication cookies are coming from logged in account. user has access of services if he has authentication token which is stored in cookie. if any other user copies the the cookie and token is not expired, he will also be authenticated. – Felt

And if I copy your Facebook cookie I can stalk your friends. See Forms Authentication Cookie value vulnerability for example for a discussion on that topic. – Narrow

@Felt please check my answer below. Your worries are valid. But check your authentication cookie and make sure it is httpOnly, and I would not give the user ability to stay logged (don't store cookies). You might also choose a short idle time out if you are so worried. – Reservist

Answer 1

The forms authentication is good enough. You can also do the following:

1. Use anti-forgery (antifrogery) tokens. Check this or this
2. It will also be great if on sensitive actions you check if the call to the function was made from the same site or not.You can implement your own action filter for this. (check if the referral site is your site, or the expected site)

Edited:

Thanks guys for your comments. I guess you are right. Well authentication cookies in ASP are created as httpOnly cookies which means even if the site had some XSS vulnerabilities it will still be safe and cant be stolen. I would also suggest to use https everywhere if the site is used for sensitive operations (like a bank) to make sure the cookies are perfectly safe.

Reservist

AntiForgeryToken is for cross-site request forgery, which has little to do with security. The referrer is by no means a way of security as it is user input. – Narrow

@Narrow It has little to do with Authentication. Preventing a cross-site forgery attack has a fair bit to do with security. – Halona

guys btw forgery attacks can be very serious – Reservist

Now my problem is that how to implement anti forgery in .aspx pages. I don,t know why but they have used .aspx pages insted of Razor view. – Felt

sorry can't help you with syntax for that – Reservist

Antifrogery? What do you have against frogs? – Amorous