ASP.

NET Web API

Creating Web Services with C#

SoftUni Team
Technical Trainers
Software University
http://softuni.bg
Table of Contents
1. What is ASP.NET Web API?
 Web API Features
2. Web API Controllers
 Actions
 Routes
 Return Types and Status Codes
 Binding Models and View Models
 Built-In User Identity
2
What is ASP.NET Web API?
ASP.NET Web API
 ASP.NET Web API == platform for building RESTful Web services
 Running over the .NET Framework

 Using the ASP.NET development stack

4
ASP.NET Web API

X HTTP
Data M GET
storage L
JSON
Data Layer ASP.NET
Models
(EF) Web API
JSON
X
M HTTP PUT,
L POST,
DELETE

5
Web API Features
 Easy to use framework, very powerful
 Modern HTTP programming model
 Access to strongly typed HTTP object model

 HttpClient API – same programming model

 Content negotiation
 Client and server negotiate about the right data format

 Default support for JSON, XML and Form URL-encoded formats

 We can add own formats and change content negotiation strategy

6
Web API Features (2)
 Query composition
 Support automatic paging and sorting
 Support querying via the OData URL conventions when we return
IQueryable<T>
 Model binding and validation
 Combine HTTP data in POCO models
 Data validation via attributes
 Supports the same model binding and validation infrastructure as
ASP.NET MVC
7
Web API Features (3)
 Routes (mapping between URIs and code)
 Full set of routing capabilities supported within ASP.NET (MVC)

 Filters
 Easily decorates Web API with additional validation
 Authorization, CORS, etc.
 Testability
 IoC and dependency injection support
 Flexible hosting (IIS, Azure, self-hosting)
8
ASP.NET Web API 2
 Attribute routing
 OData improvements: $select, $expand, $batch, $value
and improved extensibility
 Request batching
 Portable ASP.NET Web API Client
 Improved testability
 CORS (Cross-origin resource sharing)
 Authentication filters
 OWIN support and integration (owin.org) 9
WCF vs. ASP.NET Web API
 WCF is also a good framework for building Web services

10
Creating ASP.NET Web API Project
Default ASP.NET Web API Project Template
Web API Controllers
Web API Controllers
 A controller class handles HTTP requests
 Web API controllers derive from ApiController
 ASP.NET Web API by default maps HTTP requests to specific
methods called "actions"
Action HTTP method Relative URI Method
Get a list of all posts GET /api/posts Get()
Get a post by ID GET /api/posts/id Get(int id)
Create a new post POST /api/posts Post(PostModel value)
Update a post PUT /api/posts/id Put(int id, PostModel value)
Delete a post DELETE /api/posts/id Delete(int id)
Get a post by category GET /api/posts?category=news Get(string category)
13
Actions
 Actions are public methods of a controller
public class PostsController : ApiController
{
[HttpGet]
public IEnumerable<string> GetPosts()
{
return new [] { "Hello", "WS&C deadline question.." };
}

[HttpPost]
public void AddPost(string content)
{
// Add post to DB..
}
}
14
Web API Request Processing
1. Web request is sent public class PostsController : ApiController
{
http://localhost:1337/api/posts public string Get()
{
return "Some data";
2. Match controller from route }

GET /api/posts HTTP/1.1 public string Edit(Post post)

Host: localhost:1337 {
Cache-Control: no-cache ...
}
}
3. Controller Responds
public class UsersController : ApiController
HTTP/1.1 200 OK {
Content-Length: 11 ...
"some data" }

15
Creating API Controller
Live Demo
Routing
 Routing == matching URI to a controller + action
 Web API support the full set of routing capabilities from
ASP.NET (MVC)
 Route parameters

 Constraints (using regular expressions)

 Extensible with own conventions

 Attribute routing is available in version 2

17
Attribute Routing
 Routing can be done through attributes
 [RoutePrefix()] – [RoutePrefix("api/posts")]
public class PostsController : ApiController
annotates a controller {
route [Route("{id}")]
public Post Get(int id)
 [Route()] – annotates { ... }
a route to an action
[HttpGet]
 [HttpGet],[HttpPut], [Route("{id}/likes")]
[HttpPost], etc. – public IEnumerable<Like> GetPostLikes(int id)
{ ... }
specify the request }
method
18
Default Route
 Web API also provides smart conventions by default
 HTTP Verb is mapped to an action name

 Configurations can be added in WebApiConfig.cs

config.Routes.MapHtpRoute(
name: "DefaultApi",
routeTemplate: "api/{controller}/{id}",
defaults: new { id = RoutesParameter.Optional }
);

19
 PostsController

GET /api/posts HTTP/1.1

Host: localhost:1337 UsersController
Cache-Control: no-cache

CommentsController

Configuring Routes
Live Demo
 Return Types
T, IEnumerable<T>, IQuearyable<T>
IHttpActionResult
Return Types
 Actions can return several types
 Returned data automatically serialized to JSON or XML
 T – generic type (can be anything)
public Comment GetCommentById(int id) { ... }

 IEnumerable<T> - foreach-able collection of generic type T

public IEnumerable<Comment> GetPostComments(int id) { ... }

 IQueryable<T> - collection of generic type T (supports filtering,

sorting, paging, etc.)
public IQueryable<Comment> GetPostComments(int id) { ... }
22
Return Types (2)
 void – returns empty HTTP response 204 (No Content)
 IHttpActionResult – returns an abstract HTTP response with
status code + data
public IHttpActionResult GetPostComments(int id)
{
var context = new ForumContext();
var post = context.Posts.FirstOrDefault(p => p.Id == id);
if (post == null)
return this.BadRequest("Invalid post id");

return this.Ok(post); 200 OK + serialized data

}
23
Return Types
Live Demo
HTTP Status Codes
 It's a good practice always to return a status code
 Return data with concrete status code method (e.g. Ok(),
BadRequest(), NotFound(), Unauthorized(), etc.)
var top10Users = context.Users.All()
.Take(10)
.Select(u => u.Username);

return this.Ok(top10Users);

 Return only status code

return this.StatusCode(HttpStatusCode.Forbidden);

25
Returning Status Codes
Live Demo
26
Model Binding
 By default the Web API will bind incoming data to POCO (CLR)
 Will look in body, header and query string
 Request data will be transferred to a C# object
 E.g. the query string will be parsed to RegisterBindingModel
.../api/users/register?username=donjuan&password=12345

public IHttpActionResult Register(

RegisterBindingModel user) username donjuan
{ password 12345
string name = user.Username;
...
}
27
Binding Models
Request Method:POST public class AddPostBindingModel
FormData content=Hello+Guys& {
author=Gosho&categoryId=5 public string Content { get; set; }
public int AuthorId { get; set; }
public int? Category { get; set; }
Validation attributes can be }
set in the binding model

[HttpPost]
public IHttpActionResult CreatePost(AddPostBindingModel postModel)
{
if (!postModel.Category.HasValue) ...
}
28
Binding Model Validation
Request Method:POST
FormData username=Motikarq&password=#otpo6ti4kata

 ModelState holds information about the binding model

public class UsersController : ApiController
{
public IHttpActionResult Register(RegisterBindingModel user)
{
if (!this.ModelState.IsValid)
return this.BadRequest(this.ModelState);
... public class RegisterBindingModel
} {
} [Required]
public string Username { get; set; }
[MinLength(6)]
public string Password { get; set; }
public int Age { get; set; }
}
29
Using Binding Models – Example
public IHttpActionResult AddPost(AddPostBindingModel postModel)
{
if (!this.ModelState.IsValid)
return this.BadRequest(this.ModelState);

var context = new ForumContext();

var author = context.Users
.FirstOrDefault(u => u.Username == postModel.Author);
if (author == null)
return this.BadRequest("Author does not exist");

context.Posts.Add(new Post() { Content = postModel.PostContent,

Author = author, CategoryId = postModel.CategoryId });
context.SaveChanges();

return this.Ok(newPost);
}
30
Data Source Attributes
 Web API can specify request data source
 [FromUri] – binds data from query string to action parameters
http://localhost:1337/api/posts/comments?page=5

public IHttpActionResult GetComments([FromUri]int page)

{...}

 [FromBody] – binds data from request body to binding model

public IHttpActionResult Register(
[FromBody]RegisterBindingModel user)
{ ... }

31
Model Binding
Live Demo
Media Type Formatters
 MediaTypeFormatters are used to bind both input and output
 Mapped to content types
 In WebApiConfig.cs we can configure the response to return
JSON by default
config.Formatters.JsonFormatter.SupportedMediaTypes.Add(
new MediaTypeHeaderValue("text/html"));

 And JSON to follow camel case conventions

config.Formatters.JsonFormatter.SerializerSettings.ContractResolver =
new CamelCasePropertyNamesContractResolver();

33
View Models
 View models are classes which represent data to be displayed
 Used to project only needed data
[HttpGet]
public IHttpActionResult GetAllComments(int postId)
{
var post = this.context.Posts.FirstOrdDefault(p => p.id == postId);
if (post == null)
return this.BadRequest("Invalid post id");

var comments = post.Comments.Select(c => new CommentViewModel

{
Id = c.id public class CommentViewModel
Content = c.Content, {
}); public int Id { get; set; }
return this.Ok(comments); public string Content { get; set; }
} }
34
View Models
Live Demo
35
OData
 OData (http://odata.org) is a open specification
written by Microsoft
 Provides a standard query syntax on resources, e.g.:
http://localhost/api/posts?$skip=10&$take=10

 ASP.NET Web API includes automatic support for this syntax

 Return IQueryable<T> instead of IEnumerable<T>, e.g.:
public IQueryable<Comment> GetPostComments(int id) { ... }

36
OData Query Installation
 To enable OData queries
 Install the Microsoft.AspNet.OData package from NuGet

 Action return type should be IQueryable<T>

 Set the [EnableQuery] attribute above the action

 Then we can make OData queries like:
http://localhost/api/posts?$filter=Likes gt 5&$orderby=Date&$top=3

Selects posts with likes greater than 5 Takes first 3

Orders by date
37
OData Keywords
Option Description
$filter Filters the results, based on a Boolean condition
Tells the server to include the total count of
$inlinecount
matching entities in the response.
$orderby Sorts the results.
$skip Skips the first n results.
$top Returns only the first n the results.

 See full Odata URI conventions

38
Using OData – Example
public class PostsController : BaseApiController
{
[EnableQuery]
public IQueryable<PostViewModel> GetAll()
{
var context = new ForumContext();
return ForumContext.Posts
.Select(p => new PostViewModel
{
public class PostViewModel
Id = p.Id,
{
Content = p.Content,
public int Id { get; set; }
Date = p.Date,
public string Content { get; set; }
Likes = p.Likes.Count()
public DateTime Date { get; set; }
}); public int Likes { get; set; }
} }
}
39
OData with Web API
Live Demo
40
CORS
 Cross-Origin Resource Sharing allows cross domain requests
 E.g. www.softuni.bg makes AJAX request to www.nakov.com/api
 Disabled by default for security reasons, can be enabled
in Startup.Auth.cs
app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);

 Requires Microsoft.Owin.Cors middleware package installed

41
 ASP.NET Identity API
Setup, Registration, Login, Logout
ASP.NET Identity
 The ASP.NET Identity system
 Authentication and authorization system for ASP.NET Web apps
 Supports ASP.NET MVC, Web API, Web Forms, SignalR, Web Pages
 Handles users, user profiles, login / logout, roles, etc.

 Based on the OWIN middleware (can run outside of IIS)

 Automatically integrated when the Individual User Accounts

option is selected on Web API project creation

43
Identity Authentication (Login)
POST localhost:55602/Token
Username [email protected]
Password 1234567
grant_type password
localhost:55602

200 OK
access_token 22k_HP6fSFwsQ88L3_JQh9nnx3…
token_type bearer
expires_in 1209599 Sent in future requests'
userName [email protected] headers for authentication
.expires Thu, 27 Aug 2015 12:42:38 GMT
44
Request Authentication
 Access token should be put in request headers

45
ASP.NET Authorization
 Use the [Authorize] and [AllowAnonymous] attributes to
configure authorized / anonymous access for controller / action
[Authorize]
public class AccountController : ApiController
{
// GET: /account/login (annonymous)
[AllowAnonymous]
public IHttpActionResult Login(LoginBindingModel model) { … }

// POST: /account/logout (for logged-in users only)

[HttpPost]
public IHttpActionResult Logout() { … }
}
46
Check the Currently Logged-In User
// GET: /users/gosho (for logged-in users only)
[Authorize]
public IHttpActionResult GetUserInfo()
{
string currentUserId = this.User.Identity.GetUserId();
if (currentUserId == null)
{
return this.Unauthorized("Access denied");
}
...
}

47
ASP.NET Identity
Live Demo
ASP.NET Web API

https://softuni.bg/courses/web-services-and-cloud/
License
 This course (slides, examples, demos, videos, homework, etc.)
is licensed under the "Creative Commons Attribution-
NonCommercial-ShareAlike 4.0 International" license

 Attribution: this work may contain portions from

 "Web Services and Cloud" course by Telerik Academy under CC-BY-NC-SA license

50
Free Trainings @ Software University
 Software University Foundation – softuni.org
 Software University – High-Quality Education,
Profession and Job for Software Developers
 softuni.bg
 Software University @ Facebook
 facebook.com/SoftwareUniversity
 Software University @ YouTube
 youtube.com/SoftwareUniversity
 Software University Forums – forum.softuni.bg