Authenticate android app to call web api service

Question

I have an android app that have a login form for student, and I want to check the student credential at web api depending on the stored data in sql server

I have searched the web and watch many videos that talking about many scenarios and nothing helped me.

All I want is a custom validation for my rest service (so I should send the credential for each request)

• What should I do at asp.net web api service
• how I can implement that at android application

Answer 1

I have used basic authentication for security,so I should provide the base64 encoding of

username:password

in header for each request as the following

authorization: Basic 'encoded username:password

  httpGet.setHeader("Authorization", "Basic "+encodeUsernameAndPassword());

At the server side I have implemented message handler

public class BasicAuthenticationHandler : DelegatingHandler
    {
        public readonly IAuthenticationService authService;
        public BasicAuthenticationHandler(IAuthenticationService service)
        {
            this.authService = service;
        }

        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
        {
            AuthenticationHeaderValue authHeader = request.Headers.Authorization;
            if (authHeader == null || authHeader.Scheme != "Basic")
            {
                return Unauthorized(request);
            }
            string encodedCredentials = authHeader.Parameter;
            var credentialsBytes = Convert.FromBase64String(encodedCredentials);
            var credentials = Encoding.ASCII.GetString(credentialsBytes).Split(':');

            if (!authService.Authenticate(credentials[0], credentials[1]))
            {
                return Unauthorized(request);
            }

            string[] roles = null;//todo
            IIdentity identity = new GenericIdentity(credentials[0], "Basic");
            IPrincipal user = new GenericPrincipal(identity, roles);


            HttpContext.Current.User = user;


            return base.SendAsync(request, cancellationToken);
        }