Creating a WebAPI with Authentication - A TimCo Retail Manager Video

[@Noceo]

There is like a million videos out there, which already shows how to do this. So why would we need another one? Well, because you don't just show HOW to do it. You actually make it possible to understand WHAT is going on. Brilliant work, please keep it up! :-)

[@IAmTimCorey]

Thank you! I'm glad you enjoyed the video. That's what I try to do in all of my videos. My goal is to always show things in the context of the real world. How they would be used, when to use them, what the best practices are, etc.

[@nathanunderbsd5972]

@@IAmTimCorey Absolutely correct.

[@Peter-re8dp]

At 13:30 the one difference for me was, that "http:..." in the URL didn't work for Postman, because my template site was "https:..". After I corrected for that, Postman was able to get a response. I hope others will find this useful. :) Thanks for the course, Tim!

[@roko567]

Great video, as always. Really excited for this course! Just wanted to let you know I just got my first job as a software developer recently, mostly thanks to my github which I've built up using your tutorials. You've helped me take all the knowledge I've gained through years of fiddling around with spaghetti code aimlessly and use it to build an app, start to finish, with proper design and documentation in mind. You helped me make my dream of becoming a developer come true, and for that I am extremely grateful. I hope to become a patron soon, once I get financially stable, to do my part of thanking you for all the knowledge you selflessly share with the community. We do appreciate you. Cheers!

[@IAmTimCorey]

Awesome! Congrats on the new job!

[@Redagrandrei]

For those stuck in the first post command. Disable in Postman setting SSL certificate verification and make sure your link is https and not http

[@IAmTimCorey]

Thanks for sharing.

[@daviddow5591]

This helped me, thanks

[@Redagrandrei]

@@daviddow5591 Ur welcome)

[@principedinerezza]

Thank you, this was driving me crazy.

[@matthewmills2656]

Thanks, was stuck for a while on this one.

[@aaronpaul2550]

This is a very complete course. Explained very carefully and in detail. And thank you for always explaining the differences in techniques used in the working environment and the learning environment. Actual work experience is a very valuable explanation for current students.

[@IAmTimCorey]

You are welcome.

[@desousamateus114]

Tim up at 4:16am teaching us how to do this beautiful coding setup. Love your classes, keep up with the good work. When I get a C# job i'll buy all classes from your site. The best teacher out there.

[@IAmTimCorey]

Thank you! I'm glad you are enjoying the videos.

[@DjUnKnow47]

Great course , I used to be a C# mainly developper all doe now i've moved to PHP and I'm following this course and mirroring everything to PHP so far so good. Great work and thank you for your videos.

[@IAmTimCorey]

You are most welcome. Thanks for watching.

[@TheTonyBTube]

I am glad I signed up for the year pass. This lesson, so far since I am just starting, has already helped me to see the strength of Visual Studio in Authentication. I remember the days of creating our own authentication methods. This was the best-presenting treatment of the topic. Much appreciated.

[@IAmTimCorey]

I am glad my content has been helpful.

[@iam_omar]

I like how you read all the comments and reply. Thanks Good Job Tim

[@IAmTimCorey]

I try. Thanks for watching.

[@zoltanbauer2722]

one of the best tutorial video channel. As soon as I am ready I swear I will do the patreon thing.

[@IAmTimCorey]

I am glad you are getting so much value out of it.

[@jcory3761]

Hmmm I've never known Postman to allow a body of any sort be passed into a GET request. For anyone that is blocked from doing so in Postman for the token request, change the verb to POST and continue as instructed by TC. Thank you Tim for the series. I'm a MSSQL developer looking to expand into C#, particularly WebAPI for integration purposes. Your channel is blessing for it.

[@IAmTimCorey]

You are most welcome. Thanks for watching.

[@amymiddleton4984]

Make sure to like this so that it will become a top comment. I have spent hours and hours trying to figure this issue out. When I posted a comment about it, it was deleted, because of this comment I guess. So if we make this a top comment it will show up out of 600+. Thank you.

[@swssdev9163]

Where were you when I was in college. This is amazing. Clear and concise.

[@IAmTimCorey]

Thank you!

[@ElCidPhysics90]

Wow. 2 1/2 years and so much has changed with Visual Studio. Still a great course!!!

[@IAmTimCorey]

Thanks!

[@kemmrich]

Super fantastic video and course so far. Let's see -- never used gitHub before, never did an API project, never used postman. The tournament tracker course was my first "C#" project, first time doing MVC, and so on and so forth. At the same time, I am keeping up and not getting too blown away. Keep up the good work. I think my current old foxpro applications will lend themselves more to a webForms type application -- but I am keeping my options open and my bias in-check.

[@IAmTimCorey]

Awesome!

[@musandlala7991]

As usual Tim hits it out the park. Love how you keep it simple and go in-depth with the knowledge if not point in the right direction.

[@IAmTimCorey]

Glad you enjoyed it

[@thethomasproject]

Although this video is just over a year old, there was one thing that was mentioned that's a minor point but I thought I'd comment. Tim you had mentioned that you are a one man project team so you are not worried about branching to add features. I would still recommend this flow (branching off, and merging back), as a one man dev team. This allows you to work on multiple things are the same time as well as store code changes to a feature on a branch. Yes, there's the extra work on merging back to master, but this does permit a much more dynamic environment while deving. Again, small but it is handy. But I agree, excellent video. I did get some pointers on getting tokens and using them. Very cool.

[@IAmTimCorey]

Yes, it does add functionality. It just takes longer on video to display.

[@dimasprasetya9267]

Hi Tim, Just wanna say thank to you for creating this course. I have been following this course till this third video on my first day. Hope I can follow the rest in the future. And again, thank Tim!

[@IAmTimCorey]

You're very welcome!

[@Arrato1977]

The best tutorial I be ever seen. Man you are the best

[@IAmTimCorey]

Thank you!

[@Allyourneedsmet]

This man's tutorials are great, I clearly understand concepts if i'm not hasty. Thank you Tim!

[@IAmTimCorey]

You are welcome.

[@torrvic1156]

What an outstanding explanation Tim! Many thanks to you! It seems like by watching your videos I am really getting a grasp of what is the real job of software developer.

[@IAmTimCorey]

I am glad it was helpful.

[@CAPS_AMERICA]

Awesome! Simple and yet powerful! Thanks for this Tim, keep it up!

[@IAmTimCorey]

Thanks! Will do!

[@UPSCCSE-ku7ej]

@@IAmTimCorey Good

[@CoReeYe]

This was so useful. Sooooo useful.

[@IAmTimCorey]

Awesome!

[@jakew94]

Note that you cannot use the postman web client when using localhost. Install the desktop client. It's kinda obvious but might save you a quick stack overflow search.

[@IAmTimCorey]

Correct. Thanks for sharing.

[@McJiggities]

Thanks for your help.

[@RP-jp8yn]

This is an awesome video. Tim Corey does a great job at explaining things, I'll have to go through the entire playlist now.

[@IAmTimCorey]

Thank you!

[@yogevgershon3424]

Hi Tim, First of all, I love your videos. Small question, you did a get request to the token action (localhost:..../token) but I didn't see it on the page at 13:59 (localhost.../Help page) why isn't is shown?

[@hchoi84]

I was also wondering about this. My assumption was probably because it's buried deep within metadata somewhere. Meaning, it's baked into C# where as what we're seeing is an application similar to what we'd build on top of it. To prove my assumption, I began my F12 (Go to definition) journey. Here's the path if anyone's interested: Startup.Auth.cs line 39 ApplicationOAuthProvider line 53 OAuthTokenEndpointContext line 12 OAuthAuthorizationServerOptions line 33 comment has "/Token" in the summary. How this all works is waaay beyond my skill level. Everything else we see when we click on API is under Areas => HelpPage => Views => Help. I probably made like 1% dent to your question and my ever growing curiosity but, progress is progress :) Hope it did help though.

[@alimusa7058]

I would like to thank you for all the serious of valuable courses that are added a lot to my Knowledge and change it upside-down, I have already attended several courses, though I am a BMC-REMEDY expert but I believe I will start changing my skin to .NET C# with all asp.net, core, MVC because of you.

[@IAmTimCorey]

You're very welcome!

[@ben.thornhill]

Hey Tim, thanks for another awesome Video! I've heard you talk about in a couple of different videos how you're not a big fan of Entity Framework. I don't know what constitutes proper subject material for your weekly challenges, but if you made either a weekly challenge or a quick video explaining why you dislike Entity and ways to accomplish the functionality that EF seeks in different ways that would awesome. I would be super interested to hear your take on it. (You may be a video about this topic already... if so, disregard this :) )

[@IAmTimCorey]

I don't have a video on that yet (not specifically). That sounds like a good suggestion. I'll add it to the list.

[@AcademyofoneOrg1]

"It looks a lot like a guid... because it is" I don't know why but that made me bust out a laugh. Great video!

[@IAmTimCorey]

lol, I'm glad. Any time I can make a person laugh when we are writing API code, I call it a win.

[@onyebuchiboss]

ASP.Net is not my thing and I doubt i will ever use it at work, but to get the 100% of this course, i will have to follow. Thanks Tim!. My no. 1 new year's resolution is to follow this course to the Tee and gain every knowledge from you.

[@IAmTimCorey]

Excellent! Yep, I get that there are some things that you don't really want to do normally but having a well-rounded education is key in the job market.

[@patrickdaems6558]

Thanks Tim for another great video

[@IAmTimCorey]

You are welcome.

[@harag9]

Great series so far, not done web API stuff for ages as I've not had the need to, so great refresher so far - and postman is something I've never used so more on that would be good as we go through the project! Thanks!

[@IAmTimCorey]

Thanks. I'll add Postman to the suggestion list. That probably deserves a video of its own, although we will also use it more in this series, I'm sure.

[@jcoulter105]

Howdy Tim ... suggestion. Maybe consider putting together a "prerequisites" video where you cover all the software, components and web accounts (GitHub, etc) that will be needed. Where to download them, any special installation requirements, etc. I'm only on the second video and I've had to install Git and several components within Visual Studio and set up an account on GitHub. Not a huge deal, but if we know in advance what will be needed we can spend some time getting everything downloaded and installed without having the stop in the middle of the videos to do it. I'm sure some viewers already have all this stuff installed. But many, like myself, do not. Thanks for the great videos!!

[@IAmTimCorey]

Good suggestion. I'll see what I can do.

[@rohanroy9818]

Tim ji you are great....🙏

[@IAmTimCorey]

Thank you!

[@scottrellwi]

You rock Tim! Great to see a real security example, and not just a bunch of regurgitated techno babble.

[@IAmTimCorey]

Thank you!

[@buildtolove]

If Postman gave you a problem, Go to Settings\General and turn off SSL Certificate verification

[@syrymzhakypbekov1949]

thank you!

[@IAmTimCorey]

Yep, thanks for sharing.

[@shadowthehedgehog2727]

You have the best videos man

[@IAmTimCorey]

Thanks!

[@gonzalocenturion6695]

Excellent work! Thank you from Argentina

[@IAmTimCorey]

Thank you!

[@craigdanielmaceacher]

Visual Studio 2019 (16.3.7). Authentication forces SSL certificate (it creates a self-signed one for you that you must accept the risk of when you browse to the URL the first time). Additionally Postman 7.10.0 when the POST "Headers" tab "Content-Type" is left as "text/plain" will cause an exception, you must change it to "application/json" and make sure to use "" instead of ""

[@craigdanielmaceacher]

Crazy how much this stuff changes in the span of several months.... just another thing you've got learn to roll with I guess.

[@IAmTimCorey]

Yep.

[@officialspock]

Thanks Tim, your tutorials are the best.

[@IAmTimCorey]

Thanks!

[@vrace271]

Excellent video specifically the way you went through each step and explained web API with the help of POSTMAN

[@IAmTimCorey]

Thanks!

[@VAcharya]

Hi Tim very excited for this course but can I choose .net 5 version to create the project? Or it’s strictly 3.x ? Thank you for your tutorials so far.

[@IAmTimCorey]

We start with .NET Framework, then upgrade to .NET Core 3.1, and then upgrade to .NET 5. Doing it this way will give you experience with the upgrade process, not just in the final version.

[@VAcharya]

@@IAmTimCorey Thanks a ton. You are amazing!

[@faraz-online]

Excellent! Definitely matchless content!

[@IAmTimCorey]

Thank you!

[@ukaszpytel334]

Your course is really valuable!

[@IAmTimCorey]

Thank you!

[@ElTexMexAlex]

Really good at explaining c# code.

[@IAmTimCorey]

Thank you!

[@richardflores8542]

Thank you so much for this video! It helped me connect a Flutter app to my existing Identity database.

[@IAmTimCorey]

You are welcome. I'm glad it helped.

[@muczos]

I really like the idea of showing of first .net framework then .net core ;)

[@IAmTimCorey]

I'm glad.

[@laurenzvien]

I'll be watching your vids for a while, Tim. I have to create web API with swagger.

[@tomthelestaff-iamtimcorey7597]

Thanks for trusting Tim to help you thru that.

[@9paradox]

Wait why is this a GET call and not POST? 20:18

[@IAmTimCorey]

We change that later. It should be POST. Good catch.

[@ZnSstr]

As a non very experienced person I always felt insecure about Authorization, profiles, tokens etc. Gonna tackle this in the following days, thanks for the video.

[@tomthelestaff-iamtimcorey7597]

You can do this. Just take it one step at a time. You may also want to consider this video - kzbin.info/www/bejne/mGWqq5WQnc94Z6M

[@curtmantle7486]

Just to clarify something that confused me for a second. Around 40:40 Tim says that he doesn't want his packages included in the commit. There's a packages folder in your main solution folder which you can't see in Visual Studio - that's what he means. He doesn't mean packages.config file which is included in the solution. Thought I'd clarify in case anyone else was similarly unsure.

[@IAmTimCorey]

Thanks for clarifying.

[@Submarin7]

Life saver ❤

[@IAmTimCorey]

Great!

[@rahiyansafin449]

please make an authentication & authorization video for dotnet 6

[@IAmTimCorey]

Thanks for the suggestion. Please add it to the list on the suggestion site so others can vote on it as well: suggestions.iamtimcorey.com/

[@rahiyansafin449]

@@IAmTimCorey SUre !

[@thalacker]

Hi Tim, you mentioned showing the conversion to the Core Framework. Hope this is in a later video to come!

[@IAmTimCorey]

It will be. We have to build it first.

[@moihawk666]

from start to finish round 2!

[@IAmTimCorey]

Excellent!

[@Freeliner75]

At 34:20 You tell that it is easy to mismatch return value when you use methods like Ok(), and return a string instead of string [] for example. But of course you know that Ok() is a generic method and you can simply use something like: return Ok(new string[] { "value1", "value2", userId }); That will safely restrict you from passing parameter of incorrect type into Ok() and similar methods.

[@IAmTimCorey]

Yes, but it is clearer to look at the method signature and tell what it is returning if you specify the actual type. Also, I could replace that OK statement with my own that doesn't have the type and still return it.

[@roncho0o28]

Me: Watched the video Result: Now this is easy as F ! Thanks

[@IAmTimCorey]

Awesome!

[@FuzzyDPozzy]

@IAmTimCorey "Half the time or more those don't come to pass and so why spend time on something that might happen when I have plenty to do already" Apart from coding we learn and life quotes so true haha thanks for the share , love your videos i am starting to become addicted! Good job keep going!

[@IAmTimCorey]

I am glad you are enjoying it.

[@aditikumar6786]

Thank you for the wonderful explanation!

[@IAmTimCorey]

You're very welcome!

[@levzharikov6499]

Wow, so comprehensible, I couldn't imagine it would be so)

[@IAmTimCorey]

Excellent!

[@pramods6997]

Hi Tim, Thanks for the great explanation. I have a doubt as to how the api is validating the token. I don't see the token being saved anywhere in the local SQL DB. Could you please help me on this

[@IAmTimCorey]

The token is encoded, not encrypted. That means that the API can decode the token and see the various parts. One of those parts is an encrypted version of the secret key that was used. The API compares that secret key to what it has for a secret key. If the two match, it trusts the token.

[@pramods6997]

@@IAmTimCorey Thank you 🙂

[@jameswcollett]

I also am confused by where the token lives. Is it in the database somewhere?

[@EYEVISUALdotNET]

Hey TIm, great video. Is it possible to scaffold this all without the (MV)C? So purely for API projects. Or is the only way to manually remove it like you said in the end in the video?

[@IAmTimCorey]

In the .NET Framework, the two are tightly tied together. In .NET Core, which we will upgrade this to in this series, we can more easily separate out API from MVC. They both run off the same base, but we don't need to bring in the MVC parts if we don't want them.

[@EYEVISUALdotNET]

@@IAmTimCorey Thank you for the quick reply! Keep it up :)

[@default632]

Thank you, I have one day to build a basic POS and this should be good!

[@IAmTimCorey]

You are welcome.

[@default632]

@@IAmTimCorey Hi, thanks for responding. I feel I ought to give you an update. I have learned a load of info along the way. I have set up the models and scaffold-ed controller / views. I am kind of stuck from there (first experience with the whole dot net and web-dev in general). But it's been pretty fun and asp dot net core is well structured, Microsoft docs are helpful and 1 day is not enough in any case. Thank you again.

[@svantepanter]

Maybe I didn't pay enough attention, but when was the SQL Server-connection created? Was that done default by some hidden setting for the project template? PS: Your tutorials are great!

[@IAmTimCorey]

The only SQL connection we have right now is the authentication connection, which does get created as part of the template. We will set up our own SQL connection soon with Dapper. So we will have two databases, one using Entity Framework for authentication (that we don't really manipulate or change) and one that we connect to via Dapper for our application data.

[@moizali4168]

Can i expect a video series on data structures and algorithms?

[@IAmTimCorey]

I will add it to the list. Thanks for the suggestion.

[@jameswcollett]

Did you use Visual Studio 2017 in this video?

[@IAmTimCorey]

2019

[@ActiveBigB]

amazing as always - raise your hand if you watch in 1.25 speed ;)

[@IAmTimCorey]

I'm more of a 1.5x or 2x. I'm glad you found the speed that works for you.

[@ActiveBigB]

@@IAmTimCorey You are a Star!

[@prudhviraj4573]

Very good video....really appreciate your efforts

[@IAmTimCorey]

Thanks a lot

[@andikosumi545]

it was so helpful video, thank youuuuuu!

[@IAmTimCorey]

You are welcome.

[@Shubhaiss]

Hi Tim, I just bought the course from your website and went through this but got stuck at trying to get the access token with a not supported error when you execute the get command. With many hours of frustration I have solved it now and I have come to the conclusion that the video needs updating. Postman doesn't allow you send a body parameter with Get commands anymore so you have to use Post to get your token otherwise this doesn't work.

[@IAmTimCorey]

Yep, that is correct. Thanks for pointing it out.

[@timothywestern6488]

If you like me were reviewing this lesson, and couldn't get it to respond on the call to api/account/register. check the url... in 2019 seems the default is to use a self signed https: SSL cert... (so in postman I finally got an option to ignore it for testing purposes) to be able to register the user.

[@17rajasandeep]

Could you let me know how to set the postman to ignore the https?

[@hieulinhlam9083]

Thanks. this is very wonderful

[@cezar007dead8]

That's a great video! There are not a lot of information about .net Authentication in internet. If you had a video with cookie authentication, that will be great too!

[@IAmTimCorey]

I will add it to the list. Thanks for the suggestion.

[@Artavazd.kirakosyan]

Thanks for a nice video-tutorial.

[@IAmTimCorey]

You are welcome.

[@marekott4432]

Hi Tim. Quick question, why you choose to create separate database for Identity instead of creating the tables in TRMData?

[@IAmTimCorey]

I like to keep the auto-generated database separate from the database I create. It keeps a clear separation. Also, keeping the identity information separate from the rest of the data allows me to secure the database differently and back it up differently.

[@张高磊-i5l]

牛逼，终于弄懂了，非常感谢！Great video，got it finally. Thank you Sooooo much!

[@IAmTimCorey]

You are most welcome. Thanks for watching.

[@keenescouser]

Great video, would it be possible for you to make a video on what to do when the access token expires? What is the standard procedure? ask for password again? how to use refresh tokens?

[@tomthelestaff-iamtimcorey7597]

We appreciate the suggestion and I have added it to Tim's list.

[@dilhaitumhara691]

great video....thanks a lot...!!!

[@IAmTimCorey]

Glad you liked it!

[@hastifallah73]

Tim,is it possible to start this course although it is for 3 years ago? It seems great course but I'm little bit concerned about the technologies that been used in this project

[@IAmTimCorey]

Yes it is. The source code is no longer on Patreon, but you can get it by following along or you can purchase the entire course ( www.iamtimcorey.com/p/timco-app-series ). The reason why we used the technologies that we did was to simulate the real world. In the real world, you will find a LOT of organizations that are still using the .NET Framework. So, I intentionally started there. Once we built a simulation of a full application, we upgraded the application to .NET Core 3.1. Then, after adding CI/CD and more, we upgraded again to .NET 5. The purpose of this application was to show how older systems were built and to give you experience upgrading them to modern versions. The code you will use even in older systems is still relevant to modern development, so even that is good training both on older systems and newer ones.

[@hastifallah73]

@@IAmTimCorey thanks . I'll start this course by using dot net framework.

[@amallkrishna]

This video was godsent, I found very few resources discussing API authentication. Do you recommend doing this(issuing the JWT tokens from the same app) in a production environment instead of a third-party issuer?

[@youarepredictable]

Tim, how do we make this work with windows Auth, so it will just check the users AD user name and do some custom auth checking in another app database?

[@ghadahabdalmohsen8001]

if you find any helpful video share it please,I am facing the same requirement as yours

[@cmelch]

For anyone who had an issue in Postman with Error: "read ECONNRESET" when trying to create an account: I noticed my local url was using https instead of http like it was in the video. Make sure your request url is using the exact correct path. I got another error involving SSL for verifying certificates but selected the option to disable SSL and my request went through. Is there a reason why a url would have used https by default instead of http like in the video, even when following the same setup? Also, as far as SSL certificates, what is the issue with needing to disable and what would be the course for addressing this?

[@thokankit007]

Thanks a lot Connor. I would be stuck at this step for a long time if ur comment was not here.

[@MuCkLetOol]

My problem was that the webapi was running http on a separate port number, to find out what port number your http connection is running on 1. click on your project in the Solution Explorer 'TRMDataManager'. 2. Press 'F4'. 3. The properties window will open and you can see the http end point under 'URL'.

[@antoniomoyano1694]

@@MuCkLetOol This here saved me from bashing my head against a wall. Thank you stranger.

[@Fibe24]

@@MuCkLetOol thank you for that.

[@amitkbirla]

Your videos are awesome... But can you pls provide a advanced level Web API videos which includes internals structure and difference of request / response of GET, PUT, POST, DELETE with form-data, urlencoded, raw. etc.

[@IAmTimCorey]

I will add it to the list. Thanks for the suggestion.

[@HanselGraciadelBusto]

Another good one, thanks.

[@IAmTimCorey]

Glad you enjoyed it.

[@n9434178]

Hi Tim. Great video! I came across an API the other day (using swagger) that also required the user to send an x.509 certificate. I am curious how much safety this adds to the client/server interaction. If you want the API to be very secure, is this the right way to go? If useful as an extra security layer, could you perhaps show how to set this up.

[@IAmTimCorey]

A 509 certificate basically creates an identity with the server. It says that you are who you say you are, kind of like a password but in some ways better. They are a pain, though, since each client needs to set one up with the server. I don't often see them used. However, this might help you out: stackoverflow.com/questions/35582396/how-to-use-a-client-certificate-to-authenticate-and-authorize-in-a-web-api

[@n9434178]

I came across it when connecting to an api that provides details of healthcare professionals and institutions. It is only open to those who have a valid reason to lookup those details. They first need to get certified. The idea stuck in my mind though, that it may be a secure way to design an application and/or app for 1 organization that works with sensitive private data (e.g medical files) and only software clients who have a certain certificate and token can use that api. Are there perhaps better ways to achieve a very high level of security?

[@IAmTimCorey]

Two factor authentication is a good solution. It allows you to verify that the correct person is the one using the credentials. Usually it involves a hardware key or secondary device (like texting a phone, although that isn't terribly secure).

[@venkatraohyd]

You are really great

[@IAmTimCorey]

Thanks!

[@mlizano6793]

awesome! thanks for the video

[@IAmTimCorey]

You are welcome.

[@KiranRvishnu]

Thank you Tim , this was so useful.. Your videos are great. I have a request can you make a video of adding refresh tokens as a second part of this video.

[@IAmTimCorey]

I will add it to the list. Thanks for the suggestion.

[@HenrikRClausen]

This had me stumped for a while, until I realized that turning off SSL Certificate check in PostMan was the proper medicine.

[@IAmTimCorey]

Ah, yeah, they can cause issues.

[@default632]

I mean, that's one way to learn to read the error messages.

[@ralphgaston1933]

Apparently VS 2019 enforces https once you select authentication now.

[@IAmTimCorey]

That's great!

[@ramst2359]

Hi Tim, Can you help me how can I best way to design Web API with binary stream data? I mean Web API takes byte[] as input, stream as input and byte[] as output or stream as output. Thanks for your great explanation. Ram

[@IAmTimCorey]

APIs don't do well with data streams if you are expecting the stream to continue over time. In that case, look at gRPC instead. It handles long-running streams well.

[@umarabanga7462]

Worth watching

[@IAmTimCorey]

Thanks!

[@darkmift]

Im trying to follow but came to a snag @27:45 while you must have some predetermined sql connection I do not. At this point I am unsure how to proceed tbh....I quickly reviewed the previous videos but cannot see a step I may have missed...help/clarification is appreciated Edit: I managed to add mysql connection but now the framework decided its not working with utf8mb3 ...from what I gather its related to some internal mariadb workings and my attempts to by pass/override the charset to something else had no effect. Edit: went ahead and caved in....got an azure mssql online.

[@aaronhernandez1447]

Hello Tim, this is another great tutorial, however, I am a little confused about the SQL Server at minute "27:16" and right at minute "27:38" you mentioned that aspnet-TRMDataManager database is created by Entity Framework. I am assuming this means database is created automatically, but I cannot find it..........well, I found it. I just had to go to view> SQL Server Object Explorer and that is it. I am such a newbie :).. Thank Tim, you are awesome...

[@IAmTimCorey]

You are welcome.

[@Dame4Lyf3]

In creating the application flow, would you be using UML diagrams, or just a layout of each of the functionalities?

[@IAmTimCorey]

I don't use UML. I haven't seen it used in a company since college. It may be that its usage depends on where in the world you are located. Personally, I have not found full UML valuable. However, I do draw out designs and databases. I'll probably do that for this project, although I'm planning on doing smaller-scale planning at each step instead of trying to plan out the entire application all at once (agile vs. waterfall).

[@Jecyn14]

So, I'm coming into this lesson knowing nothing about web API, or anything this video really covers. I'm wondering what kind of prerequisites you'd give for this series? is this something I can hop into once I've got the basics of C# down, or is there something I need to cover to bridge the gap from being decent at C# and this course?

[@vitorvs]

Im doing the same thing, know nothing about web API, just C# basics. How are you doing after two weeks?

[@uvieemma3854]

@@vitorvs @jecyn how are you guys doing so far?

[@jimmyy.6504]

hey Tim!, can you do a tutorial on calling a rest api with basic authentication on a windows service in c#

[@IAmTimCorey]

I answered you on your other post.

[@maheshsingh2205]

Hey Tim, Great Video... a quick question... you also showed the database, was that created by default when you added the web api project into your solution?, and secondly, does the default code for POST will update the database with userid and pwd info?

[@IAmTimCorey]

The database was created the first time I asked for data or tried to insert data. It was created by Entity Framework auto-magically. The OAuth code used for authentication and authorization is written to use that database directly.

[@maheshsingh2205]

@@IAmTimCorey thanks Tim... Will try this during the weekend today...

[@Marko-the-Beast-Master]

Hello, can I somehow specify that the tables AspNetusers etc. during the registration process should be created under my specific database and not create their own one? I want to keep it together under one project database.

[@IAmTimCorey]

Yes, you can. However, then you are going to run into potential issues in that the authentication database is automatically created with Entity Framework. If you try to modify it, you will have two different systems that both have control over making changes to the database. That's not ideal. That's just one of the reasons why I prefer to keep them separated.

[@Marko-the-Beast-Master]

@@IAmTimCorey ok thx I will try to explain to our server admin, that you said its not a good idea :)

[@kidstube3239]

Aren't your rolling your own authentication by doing this? Would it be easier to just add an identity provider on azure where the app is likely to be hosted?

[@IAmTimCorey]

It is the Microsoft-provided authentication system, but it is local. So, no, I'm not rolling my own (that would be bad), but I am using local authentication instead of a service. A service is a great option, but there are enough out there that you get a lot of fragmentation (and possible expenses). For instance, if you want users with permission levels, you could use Azure Active Directory (if you are using Azure and not AWS or another cloud provider), but then if you wanted to allow users to register, you would need to add Azure Active Directory B2C.

[@remiduplan8449]

how is it possible to have body enabled when you select a get method ?

[@IAmTimCorey]

It is an option in Postman that actually puts the values in as query parameters.

[@JoshyHJoshy]

I think I forgot to add authentication and individual user accounts. Is there any way I can do that afterward, or do I have to start over creating a blank solution, etc?

[@IAmTimCorey]

Not in .NET Framework, at least not directly. In .NET Core, we can add it later. What you can do, though, is create a new project with authentication and then copy over all of the pieces of authentication to the existing API.