Call Secure ASP.Net API from Windows 8 Phone App with WebClient - asp.net

Question

i cretaed my own windows phone app based on this touturial: http://www.asp.net/web-api/overview/mobile-clients/calling-web-api-from-a-windows-phone-8-application
So far everyting is working.
Now i secured my Controller with [Authentication].
When i call the API from a browser, i get redirected to a loginpage with forms Auth.
The same thing when i try to get the records from my phone app. Can anyone help me coding the webClient to the get all my data from the webapi with the Windows 8 Phone App?
Asp.net API Controller:
public class AlertsController : ApiController
{
private AlertRepository repository = null;
public AlertsController()
{
this.repository = new AlertRepository();
}
[HttpGet]
[Authorize]
public HttpResponseMessage Get()
{
IEnumerable<AlertDetails> alerts = this.repository.ReadAllAlerts();
if (alerts != null)
{
return Request.CreateResponse<IEnumerable<AlertDetails>>(HttpStatusCode.OK, alerts);
}
else
{
return Request.CreateResponse(HttpStatusCode.NotFound);
}
}
enter code here
The WebClient in MainViewModel from the PhoneApp:
using System;
using System.Collections.ObjectModel;
using System.ComponentModel;
using AlertCatalog.Resources;
using System.Net;
using AlertCatalog.Models;
using Newtonsoft.Json;
namespace AlertCatalog.ViewModels
{
public class MainViewModel : INotifyPropertyChanged
{
const string apiUrl = #"http://localhost:25518/api/Alerts";
public MainViewModel()
{
this.Items = new ObservableCollection<ItemViewModel>();
}
/// <summary>
/// A collection for ItemViewModel objects.
/// </summary>
public ObservableCollection<ItemViewModel> Items { get; private set; }
public bool IsDataLoaded
{
get;
private set;
}
/// <summary>
/// Creates and adds a few ItemViewModel objects into the Items collection.
/// </summary>
///
//Create an instance of your new CookieAware Web Client
public void LoadData()
{
if (this.IsDataLoaded == false)
{
this.Items.Clear();
this.Items.Add(new ItemViewModel() { ID = "0", LineOne = "Please Wait...", LineTwo = "Please wait while the catalog is downloaded from the server.", LineThree = null });
WebClient webClient = new WebClient();
webClient.Credentials = new NetworkCredential("testusername", "testpassword");
webClient.Headers["Accept"] = "application/json";
webClient.DownloadStringCompleted += new DownloadStringCompletedEventHandler(webClient_DownloadCatalogCompleted);
webClient.DownloadStringAsync(new Uri(apiUrl));
}
}
private void webClient_DownloadCatalogCompleted(object sender, DownloadStringCompletedEventArgs e)
{
try
{
this.Items.Clear();
if (e.Result != null)
{
var alerts = JsonConvert.DeserializeObject<AlertDetails[]>(e.Result);
int id = 0;
foreach (AlertDetails alert in alerts)
{
this.Items.Add(new ItemViewModel()
{
ID = (id++).ToString(),
LineOne = alert.Severity,
LineTwo = alert.Name,
LineThree = alert.Description.Replace("\n", " ")
});
}
this.IsDataLoaded = true;
}
}
catch (Exception ex)
{
this.Items.Add(new ItemViewModel()
{
ID = "0",
LineOne = "An Error Occurred",
LineTwo = String.Format("The following exception occured: {0}", ex.Message),
LineThree = String.Format("Additional inner exception information: {0}", ex.InnerException.Message)
});
}
}
ErrorMessage:
Error from PhoneApp

Answer 1

Simply adding webClient.Credentials = new NetworkCredential("testusername", "testpassword"); does not mean that your api will recognise the user as authorized.
You can derive from the AuthorizeAttributeto specify your own authorization rules.
e.g.
public class MyAuthAttribute : AuthorizeAttribute
{
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
//Implement your own checks here
//httpContext.Request.Headers["yourHeaderToCheck"]
return true;
}
}
Then replace [Authorize] with [MyAuth]