How do I make API open for internal and secured from external

Question

0.00/5 (No votes)

See more:

Hello,

I have one .Net core project for API and I have requirement of External and Internal API usage. In simple word I need to make API open for internal users and secured for external users. When internal user hit the endpoint it should not asked for any type of credential but if external user hit the endpoint API should asked for the security.

How can I achieve this?

What I have tried:

I have tried to explore azure services but can't figure out.

Posted 21-Jan-20 20:28pm

Ankur Ramanuj

Updated 22-Jan-20 2:08am

Add a Solution

Comments

F-ES Sitecore 22-Jan-20 4:58am

What do you define as an "internal user" and an "external user"?

Ankur Ramanuj 22-Jan-20 5:27am

That's a main question roaming in my mind
1) How to identify user
2) How to prevent on single url

F-ES Sitecore 22-Jan-20 5:38am

What do *you* consider an "internal" user to be and an "external" user? These are not terms with standard definitions so your concept of internal and external might differ from someone else's.

Ankur Ramanuj 22-Jan-20 6:16am

Internal user meant to me is users from my organization or in other words in house developers.
External users are some one to whom I sell my APIs. means someone outside the organization.

Main goal is when in house developer call API they don't need to pass anything like credential but someone outside the organization try to call the same API they need some verification like authentication.

How can I achieve this?

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

MadMyche · Answer 1 · 2020-01-22T02:09:00

There are a couple of possibilities to use.

The first method would be based on some sort of IP Filtering.
1. API will need to be written to require an authentication token.
2. Incoming requests would be intercepted before the endpoint, and if the incoming request matches your corporate IP Address you could inject a fixed token, so they would not need to authenticate.
I personally think this is a set of hacks and bandages and do not recommend

The second method would be to create separate endpoints for the internal and external users; one needing authentication and the other does not. These two would be simple wrappers calling the main API methods.