title: How to setup auth token security for WebAPI requests?
body: <p>In following <a href="http://codebetter.com/johnvpetersen/2012/04/02/making-your-asp-net-web-apis-secure/" rel="nofollow">this</a> tutorial (modifying it to use an application-based auth string rather than their user model), have the following <code>TokenValidationAttribute</code> defined and set this attribute on WebAPI controllers in order to verify that the API request came within my web application:</p>
  
  <pre><code>public class TokenValidationAttribute : ActionFilterAttribute
  {
      public override void OnActionExecuting(HttpActionContext actionContext)
      {
          string token;
  
          try
          {
              token = actionContext.Request.Headers.GetValues("Authorization-Token").First();
          }
          catch (Exception)
          {
              actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.BadRequest)
              {
                  Content = new StringContent("Missing Authorization-Token")
              };
              return;
          }
  
          try
          {
              var crypto = new SimpleCrypto.PBKDF2(); // type of encryption
              var authPart = ConfigurationManager.AppSettings["AuthorizationTokenPart"];
              var authSalt = GlobalVariables.AuthorizationSalt;
              var authToken = GlobalVariables.AuthorizationToken;
  
              if (authToken == crypto.Compute(authPart, authSalt))
              {
                  // valid auth token
              }
              else
              {
                  // invalid auth token
              }
  
              //AuthorizedUserRepository.GetUsers().First(x =&gt; x.Name == RSAClass.Decrypt(token));
              base.OnActionExecuting(actionContext);
          }
          catch (Exception ex)
          {
              actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Forbidden)
              {
                  Content = new StringContent("Unauthorized User")
              };
              return;
          }
      }
  }
  </code></pre>
  
  <p>In my login class, I have the following method defined that returns a <code>User</code> object if valid:</p>
  
  <pre><code>    private User IsValid(string username, string password)
      {
          var crypto = new SimpleCrypto.PBKDF2(); // type of encryption
          using (var db = new DAL.DbContext())
          {
              var user = db.Users
                  .Include("MembershipType")
                  .FirstOrDefault(u =&gt; u.UserName == username);
              if (user != null &amp;&amp; user.Password == crypto.Compute(password, user.PasswordSalt))
              {
                  return user;
              }
          }
  
          return null;
      }
  </code></pre>
  
  <p>As you can see, the user login validation method doesn't make a WebAPI call that would be to <code>~/api/User</code> (that part works).</p>
  
  <p>1)  How do I generate a request with with auth token (only site-generated API requests are valid)?  These could be direct API calls from code-behind, or JavaScript-based (AngularJS) requests to hydrate some objects.</p>
  
  <p>2)  I'm not entirely clear on what <code>base.OnActionExecuting(actionContext);</code> .  What do I do if the token is valid/invalid?</p>