Secure ASP.NET Core Web API using API Key Authentication

I am implementing the simple web service that grants access via usual login and api login with some token. I have googled a bit for good solution but found it for asp.net mvc 5 application only (original article - Secure ASP.NET Web API using API Key Authentication – HMAC Authentication).

So it is something that helps me to do the same stuff for asp.net core that I am using for my web services.

First of all, I went through great workshop related to the various new pieces in ASP.NET Core Authorization - AspNetAuthorizationWorkshop. Also, check out the great article about Filters.

But both these materials are focused on Authorization, it is nice to know but for our purpose, we have to use Authentication.

I implemented custom AuthenticationHandler and override there HandleAuthenticateAsync. I returned AuthenticateResult.Success when request met requirment and AuthenticateResult.Fail in otherwise.

When handler was implemented I needed to configure service to use it. I wrote next code in Startup.ConfigureServices method:


And marked controller/action that I needed to protect:


Vu'a la, it works now.

PS: I used AddMvcCore() rather AddMvc() for better performance. Also, I added AddJsonFormatters for exploring JSON in respoce and AddAuthorization to use security.

You could find source there on GitHub.

EDIT:
My implementation had the bug; it related to the way how to request.body works. If the request.body was read already before during request pipeline, then it is empty when you try to read it the second time. AuthenticationHandler reads request.body for computing hash, so model binder can't process correct binding from request.body to post or put parameters. But this bug is easy to fix I have to enable rewind for body stream (Allow rewind request.EnableRewind(); and rewind request.Body.Position = 0;).

I have already updated sources code on GitHub.