Click here to Skip to main content
15,884,176 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
I am doing a rest call. The service url that I want to call should be fetched in the oracle database. I am fetching it using a query and assign to variable called 'url'.I want to add parameters 'keyname' and 'keyvalue' with this url and use it in rest call.

What I have tried:

This is the way I am following.
public async Task RunAsync(string name, string value)
        {
	    using (var handler = new HttpClientHandler { UseDefaultCredentials = true })
            using (var client = new HttpClient(handler))
            {
var byteArray = Encoding.ASCII.GetBytes("username:password");
                client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Basic", Convert.ToBase64String(byteArray));
                client.BaseAddress = new Uri(HomeController.url);
                client.DefaultRequestHeaders.Accept.Clear();
                client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
                HttpResponseMessage response = await client.GetAsync(HomeController.url);
----}
I want to add 'keyname' & 'keyvalue' parameters to this ur. Is there any secure method to do it?
Posted
Updated 24-Mar-18 6:15am
Comments
F-ES Sitecore 22-Mar-18 5:36am    
You'd have to encrypt the params before you send them and then decrypt in the rest method to get the data back. I'm sure if you google "c# encrypt rest parameters" you'll find examples.

1 solution

The current thinking on sending credentials via a REST service is that you should be using SSL in which case it's not necessary to encrypt or hash the credentials.

If you are not sending the credentials via SSL it will make no difference whether you hash or encrypt the credentials as anyone who intercepts that request can now authenticate and spoof as the user in the request.

So basically don't encrypt or hash data at the client - it's pointless and you should really be thinking about using SSL in which case you can send plain text passwords and return a token or whatever you will be using to show authentication has taken place.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900