Calling webapi only when client has install certificate in his machine

Question

I wanwt to add a layer of security via certificate to access a hosted ASP.NET WebAPI.

I want only those clients who have installed the certificate in their machine to have access to that WebAPI.

Can anyone provide me a way to achieve this behavior?

Answer 1

You can configure IIS to require client certificates without writing a single line of code. Just follow these instructions, specifically these:

4. Click SSL settings in the middle panel and select Require SSL and Require for Client certificates.

5. Double click the Authentication icon and disable all the Authentication method.

6. Make sure the IIS Client Certificate Mapping Authentication is installed.

7. Click the Configuration Editor in the middle panel and set the one to one mappings refer to this link

Answer 2

Just as suggested in comments, a quick google search could lead to interesting results.

Nevertheless a possible solution is the implementation proposed in the following Microsoft article :

public class RequireHttpsAttribute : AuthorizationFilterAttribute
{
    public override void OnAuthorization(HttpActionContext actionContext)
    {
        if (actionContext.Request.RequestUri.Scheme != Uri.UriSchemeHttps)
        {
            actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Forbidden)
            {
                ReasonPhrase = "HTTPS Required"
            };
        }
        else
        {
            base.OnAuthorization(actionContext);
        }
    }
}

You would then decorate your ApiController action :

public class SomeController : ApiController
{
    [RequireHttps]
    public HttpResponseMessage Get() { ... }
}