Pluralsight - Building and Securing a RESTful API for Multiple Clients in ASP.NET - 2015

Year : 2015
Manufacturer : Pluralsight
Author : Kevin Dockx
Duration : 5h 4m
Language : English


We all seem to be building RESTful APIs with ASP.NET Web API these days. But REST is bigger than that: it's an architectural system. If you're looking to learn what REST actually is and how to build a RESTful API with ASP.NET Web API, aimed at multiple client types (web / mobile), you're in the right course. This course is filled with best practices concerning URI design, data shaping, paging, caching, and versioning. It's very demo-driven, and we start from scratch. It contains an API and two different clients: an ASP.NET MVC client and a mobile client. To top it off, you'll also learn all about securing both client apps and the API with OAuth 2.0 and OpenID Connect. The focus is on what works for standardized API development for multiple (possibly cross-platform) clients.


Introduction 13:19
Introduction 4:07
Demo Case Introduction 1:04
Gathering Functional, Technical, and Environmental Requirements 7:09
Summary 0:56

Building the API - REST and Web API Primer 16:17
Introduction to REST 3:35
REST Architectural Constraints 2:46
REST Architectural Constraints - Uniform Interface 3:37
REST Architectural Constraints - HATEOAS 1:50
The Case for Pragmatism 2:00
Introduction to ASP.NET Web API 0:47
Summary 1:39

Building the API – Implementing Basic Requirements 1:02:35
Introduction and Designing Resource URIs 4:50
Interacting with Resources 3:49
HTTP Status Codes 2:38
Demo - Solution Overview and Getting a List of Resources with GET 8:48
Demo - Getting a Single Resource with GET 5:21
Demo - Formatters and Result Formatting 1:56
Demo - Creating a Resource with POST 3:46
Demo - Updating a Resource with PUT 2:51
A Few Words on PATCH 2:11
Demo - Partially Updating a Resource with PATCH 3:57
Demo - Deleting a Resource with DELETE 1:49
Demo - Relations and URI Mapping 5:44
Demo - Sorting 4:14
Demo - Filtering 2:24
Implementing Paging Support 1:59
Demo - Paging 5:21
Summary 0:48

Building the API – Implementing Advanced Requirements 33:08
Introduction to Data Shaping 1:49
Demo - Allowing Field-level Selection with Data Shaping 4:18
Demo - Allowing Inclusion of Associations with Data Shaping 3:57
HTTP Caching 3:52
Demo - HTTP Caching 3:00
Breaking REST with OutputCache 1:21
Versioning Strategies 4:07
Demo - Versioning Strategies 7:08
What About Transactions? 2:30
Summary 1:02

Deploying the API 13:54
Introduction and Deployment Overview 2:29
Demo - Deploying the DB to Azure 4:48
Demo - Deploying the API to Azure 1:20
Cross-origin Resource Sharing 1:59
Demo - Cross-origin Resource Sharing 2:28
Summary 0:48

Consuming the API 46:47
Introduction 1:56
Demo - Retrieving Resources 7:01
Demo - Creating Resources 3:11
Demo - Editing Resources 2:41
Demo - Deleting Resources 1:05
Demo - Sorting Resources 0:55
Demo - Paging Resources 5:41
Demo - Data Shaping 2:26
Demo - Editing Resources (partial) 4:51
Demo - Versioning 3:12
Demo - Filtering Resources 2:32
Choosing Where to Use HttpCache 2:30
Demo - Caching 7:44
Summary 0:54

Security - From What Used to Work to What Works Today 28:29
Introduction and a Few Important Definitions 2:15
An Old, Familiar, yet Insufficient Approach (Forms Authentication) 2:13
A Better, yet Insufficient Approach (WS-Federation) 3:40
Introduction to OAuth 2.0 2:20
OAuth 2.0 Client Types 1:47
OAuth 2.0 Protocol Endpoints 1:22
Authorization Code Grant 3:53
Implicit Grant 2:35
Client Credentials Grant 1:06
Resource Owner Password Credentials Grant 2:50
Introduction to OpenID Connect 2:05
Hybrid Flow 1:12
Summary 1:05

Configuring and Deploying a Security Token Service 14:11
Choosing a Security Token Service 2:19
Clients, Scopes, and Users 2:00
Demo - Hosting, Configuring, and Deploying IdentityServer 9:20
Summary 0:30

Securing the Client Applications (OAuth 2.0 and OpenID Connect) 45:20
Introduction and MVC Client: Choosing the Correct Flow 2:09
Demo - Hybrid Flow 7:42
Demo - UserInfo Endpoint 3:10
Demo - Claims Transformation 6:29
Demo - Role-based Authorization 4:25
Demo - External Providers (Facebook) 5:46
Demo - User-specific Data - Client Responsibility 1:46
WP Client: Choosing the Correct Flow 0:34
Demo - IIS Express and Windows Phone 2:31
Demo - Implicit Flow 9:14
Summary 1:30

Securing the API (OAuth 2.0 and OpenID Connect) 30:55
Introduction 0:32
Demo - Calling the API on Behalf of the User 4:31
Demo - Role-based Authorization 6:12
Demo - User-specific Data - API Responsibility 2:40
Demo - Client Credentials: Server to Server 5:36
Demo - API Access Through Implicit Flow 1:30
Demo - Refresh Tokens 6:34
Summary 0:56