WebApiContrib/WebAPIContrib — pull request #59 by kurtschindler (2012-04-24 21:47:10+00:00)
Title: Added BasicAuthenticationHandler and RequireHttpsHandler

The RequireHttpsHandler is simple: It checks that request.RequestUri.Scheme is of Https and returns a Forbidden response if not.

BasicAuthenticationHandler is an abstract class that would be implemented like so:

public class MyBasicAuthHandler : BasicAuthenticationHandler
{
protected override bool Authorize(string username, string password)
{
//my code to determine if credentials are valid
return username == "user" && password == "expectedpassword";
}

protected override string Realm
{
get { return "whatever"; }
}
}

If Authorize() returned false here then the response generated would be 401 with the header:

WWW-Authenticate: Basic realm="whatever"

My understanding is that realm is required, hence the mandate on overriding it. You can supply a null value and it'll be set to an empty string.