Azure Mobile App Service APIkey

Question

I created an Azure Mobile App Service which is currently accessible 'Anonymously'

Anonymous access is enabled on the App Service app. Users will not be prompted for login.

To make it secure I can enable App Service Authentication which will ask users to log in

But this is not what I want - The data in this app is only accessed by Application without the need of each and every user to login to my app before using it.

So you might say, in this case, Anonymous access is fine but I want to restrict it with something at least like an API Key so I will have access to the API which my app can use to access the data to prevent random requests as anyone can just go and use Postman and start getting data without any authentication.

So in short, I don't want individual user authentication, but at least an API Key to ensure only requests made from my app are authenticated and nothing else.

I am using the following in my mobile app to create a connection and also doing Offline sync etc

MobileServiceClient client = new MobileServiceClient(applicationURL);

Any idea how do I do that?

FYI. My server side backend is in C#

Bruce Chen Bruce Chen · Accepted Answer · 2018-07-02T03:18:09

Since you are using Azure Mobile Apps, for your requirement, you could leverage Custom Authentication for building your CustomAuthController to login and generate the JWT token for a specific user without user interaction. The core code snippet for logging would look like as follow:

MobileServiceClient client = new MobileServiceClient("https://{your-mobileapp-name}.azurewebsites.net/");
client.LoginAsync("custom", JObject.FromObject(new{Username="***",Password="***"}));

Note: As the above tutorial mentions as follows:

You must turn on Authentication / Authorization in your App Service. Set the Action to take when request is not authenticated to Allow Request (no action) and do not configure any of the supported authentication providers.

And you must explicitly add [Authorize] attribute for your controllers / actions which need to be authorized access. Details you could follow Authentication in the Backend.

Azure Mobile App Service APIkey

1 Answers