Securing .Net Core Website

Question

Hello everyone and thanks for the help in advance. I am developing a public facing website that needs to be secured against a nonpublic facing database located on a separate server. I have read articles such as https://learn.microsoft.com/en-us/dotnet/architecture/microservices/secure-net-microservices-web-applications/ which describes using oAuth2 and the like. I am very inexperienced using this technology and feel there are somem missing pieces. My thinking is that the public facing site needs to post the user name and password to an api on the nonpublic server, authenticate the user, then issue a cookie, but I am confused about how to actually implment this. Do I need to authorize the application initally using oAuth? Do I issue the cookie from the public server? Any help would be appreciated.

Answer 1

If you are concerned about authentication, Azure takes care of that.

If you're concerned about authorization then your concern is valid.

My understanding is that you have a website Public Facing
This website is going to authenticate users by using Azure AD or a public form of authentication (Facebook, Twitter etc...)

Is that right?

Answer 2

Thanks for the response. Neither site uses Azure or any type of public authentication. The non-public api uses a SQL Server database fueled by a very large intranet. User data is maintained within the Sql database and not within AD or Azure. The public facing site needs to authenticate against this Sql database and also authorize user roles.

Answer 3

Hi

There are a couple of things going on in your requirement:

• You have a website - let's say A
• You have an API - let's say B. This is not known to the world

From fundamentals of security perspective - you should not be relying on a cookie from A in B to authenticate/authorize. So what is recommended is:

• Users authenticate themselves with A using their own user name and password.
• A should generate an OAUTH token with all the information.
• A makes a call to B and passes the OAUTH token in Authorization header.
• B validates every request it gets and checks for the OAUTH token in the Authorization header. Validation can be who issued the token (in this case A), to whom was this issued (in this case B).
  If no valid token found in header - its an unauthorized access, deny the request

Now, in order to develop this - you will need to look for the documentation on following things:

• ASP.NET Core Identity with JWT bearer. Here is a stack overflow question that can give you pointers: https://stackoverflow.com/questions/45904955/dotnet-core-2-0-use-identity-with-jwtbearer-authentication
• ASP.NET Core Web API with JWT Bearer. This should give you some pointers https://devblogs.microsoft.com/dotnet/jwt-validation-and-authorization-in-asp-net-core/

Hope this helps.

Answer 4

My thinking is that the public facing site needs to post the user name and password to an api on the nonpublic server,

Sounds correct. The community has no idea how the network is configured but usually a public facing server (Internet) is the only service allowed to access application services (web services). This is accomplished with firewall configuration.

then issue a cookie, but I am confused about how to actually implment this.

UI applications like MVC or Razor Pages still use cookie authentication to authorize requests coming from a browser (user-agent). The initial authentication request flows through the application services rather than hitting the database directly.

Use cookie authentication without ASP.NET Core Identity

Typically OAuth secures web services exposed to the public or applications running in the cloud. It's not clear from your decryption if OAuth is overkill or not.