6

I am building a RESTful service using ASP.NET Web API with custom token based authentication. The client will send credentials on the first call. The service will create an encrypted token using the user details and this token will be used for authentication from this point onwards. Now the service needs to send this token back to the client. Initially I kept the token in a HTTP custom response header so that the client can read the value independent of the data returned by the service. This worked well when client and service are in the same domain, but failed in Cross domain scenario. I have CORS enabled my Service and added all kinds of headers like "Access-Control-Expose-Headers", "Access-Control-Allow-Origin: *" etc. But the cross domain client is not able to read the custom response header I created which is "SecureToken:". I saw in couple of posts that web browsers have some issues with reading custom response headers in cross domain scenarios. So now I am thinking of sending the secure token through a common base class of all the ViewModel/data objects sent from the service.

From this context I have couple of questions:

  1. What is the best place to send custom secure tokens. Is it in response header or as a common property in the base class of the ViewModel/data classes?

  2. is there a standard HTTP response header that I can use to send token and custom information so that even cross domain clients can also read it?

Any help will be greatly appreciated! Thanks!

Improve this question
1
  • Hi tpeczek - Thanks for taking time to look in to this question. Ive seen this article before:codebetter.com/johnvpetersen/2012/04/02/… . Ive already implemented token based authentication which is using private key encryption. The question is how to send updated token (when the session time out is updated, new token is generated) without logging out the user. A specific response header was the best option, but unfortunately cross domain clients cant read non standard response headers Commented Sep 27, 2012 at 10:58

1 Answer 1

Reset to default
3

The Authorization header is intended for this. Check section 14.8 in this link for details on how to use it.

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

isnt Authorization a request header? I was asking about Http "Response" header.
Authorization is a valid header for both request and response. You can/should definitely use the Authorization header with a custom scheme to return the token

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.