Is there much authentication overhead when WebAPI makes a request to the server?

Question

From what I understand. Every time a webapi request goes to the server then it's authenticated. My application uses WebAPI 2, Identity 2 and has get methods such as this:

/api/cityStatusList
/api/cityTypeList
/api/cityOptionList

These calls exist to get data for a page.

If the webapi is authenticating every request then should I look into how I can combine all these requests into one?

Answer 1

If the webapi is authenticating every request then should I look into how I can combine all these requests into one?

Why, is it causing any trouble?

You can of course define and return a class like this:

public class CityData
{
    public List<CityStatus> StatusList { get; set; }
    public List<CityType> TypeList { get; set; }
    public List<CityOption> OptionList { get; set; }
}

Answer 2

Create CityView model class for your city like following :

        public class CityView
        {
            public List<cityStatusView> cityStatusList { get; set; }
            public List<cityTypeView> cityTypeList { get; set; }
            public List<cityOptionView> cityOptionList { get; set; }       
        }
        public class cityStatusView
        {
            public int ID { get; set; }
        }
        public class cityTypeView
        {
            public int ID { get; set; }
        }
        public class cityOptionView
        {
            public int ID { get; set; }
        }

use it like following code in your web api :

 // View model 
        var cityStatusList=..;
        var cityTypeList=..;
        var cityOptionList=..;
        CityView objVM = new CityView();
        objVM.cityStatusList = cityStatusList;
        objVM.cityTypeList = cityTypeList;
        objVM.cityOptionList = cityOptionList;

        return ActionContext.Request.CreateResponse(HttpStatusCode.OK, objVM);

Answer 3

To address the question directly - yes, it is authenticating your application every time. However, on the scale of standard web-application this time is don't-you-even-worry-about-it miniscule.

Combining those routes into one might well be a good idea not because authentication has to happen multiple times, but because a web request can simply take a while. Typically this is due to the time it takes to physically send signals from the server to the client over TCP/IP (and re-send to compensate for any dropped packets). Even when parallelizing requests, fewer web requests is faster.

That being said, by default I would do the simplest thing possible and not worry about it. What I just mentioned is an optimization, should be treated as such, and not done prematurely.

As for authentication? It's just a few steps of the super-marathon that is your web request, it really doesn't matter. Someone correct me if I'm wrong, but I don't think it usually even hits the database - all it has to do is decode the claims that are stored in a cryptographically-secure fashion in the authentication cookie.