Azure Mobile Services, HttpClient, authorization

Question

Can I use the .NET HttpClient to access the Azure Mobile service?

How do I authenticate using the Mobile Service created in custom authentication / authorization templates using HttpClient?

This always returns 401 because I do not pass any credentials for authentication:

var client = new HttpClient(); var response = client.GetAsync("http://localhost:49190/api/test").Result; 

Also, when I use the Mobile Service Client , why does my application key, master key, or auth user key always return (401) Unauthorized?

Client:

 var mobileClient = new MobileServiceClient("http://localhost:49190/", "[my key]"); var response = mobileClient.InvokeApiAsync("test").Result; 

Service sector:

 [AuthorizeLevel(AuthorizationLevel.Application)] public class TestController : ApiController { public ApiServices Services { get; set; } // GET api/Test public string Get() { Services.Log.Info("Hello from custom controller!"); return "Hello"; } } 

Answer 1

"Can I use the .NET HttpClient to access the Azure Mobile service?" The short answer is yes. A simple way is to add this to the headers on the client:

  var client = new HttpClient(); client.DefaultRequestHeaders.Add("X-ZUMO-APPLICATION", "[my key]"); 

Be careful if you are using a locally hosted version, you will want to make sure that you have ...

• It made the service think it was hosted so that it included authentication.

  (in App_Start / WebApiConfig.cs: config.SetIsHosted(true);

• Added application key and main key to web.config:

   <appSettings> <add key="MS_MasterKey" value="[your master key]" /> <add key="MS_ApplicationKey" value="[your app key]" /> </appSettings> 

Without # 1, authentication through the service will be completely ignored, and therefore, you do not know if your authentication works on the client. Without # 2, you can add a key to the client (which you get from Azure), whatever you want, but it will always return 401. This may be the answer to the second question related to using MobileServiceClient , always returning 401.

Finally, there are three different headings that you can use as a whole. You use each with each different level of authorization. From this MSDN document :

• X-ZUMO-APPLICATION - key of the mobile service application. If necessary, you must specify a valid application key to access the table operation. This is the default permission to access the table.
• X-ZUMO-AUTH is the authentication token created by the service for the authenticated user. You must specify the token for the authenticated user when required to access the table operation.
• X-ZUMO-MASTER is the master key of the service. You should enable this key only if administrator access is required to access the table operation.

Author's note: I personally struggled to make this work, and with limited or missing documentation for this particular style, I wanted to write this Q / A. Please let me know if you think I should add something.