
### How to secure ASP.NET with your Ethereum account {#how to secure ASP.NET with ethereum account}

A common problem that arises when using Decentralized Applications (dApps), or other services that function on a blockchain, is being able to quickly and securely authenticate a user so they can log in with ease.

In this article, we’ll take a deep dive into all things web3 and explore how you can access blockchain-based services using your cryptocurrency account as an authentication tool. The main component necessary to accomplish this is an API layer that serves to exchange the user’s credentials. Let’s take a look at how we can do that.

### What is a blockchain? {#what is blockchain}
In simple terms, a blockchain is a digital ledger that contains records of transactions in ‘blocks’. Unlike traditional ledgers that are stored and maintained in one location by a centralized administrator, this ledger is decentralized and distributed across multiple computers.

The advantage of using such a blockchain compared to centralized systems is primarily the ability to verify and audit transactions independently, at a low cost, and with a high degree of fidelity. This is mainly because any independent record or block cannot be accidentally or maliciously altered without altering all subsequent ‘blocks in the chain’.

### What is a cryptocurrency? {#what is cryptocurrency}
A cryptocurrency is a digital commodity, security, or currency that is designed to work on a distributed, decentralized network rather than a central authority like a bank or government. In this case, it refers to a blockchain that operates on a peer-to-peer network.

The name cryptocurrency comes from the fact that it is secured using cryptographic algorithms. Since the currency is on a distributed ledger, where every person has access to a record of every transaction, encrypting the data is a necessity.

### Types of cryptocurrencies in the market
- **Bitcoin**: The first, most well-known, and most widely used cryptocurrency is Bitcoin. It also has the highest market capitalization of all cryptocurrencies by far, crossing over $800 billion in 2022. Various examples of decentralized digital currencies emerged following its creation. However, Bitcoin stayed at the forefront, growing significantly in popularity in 2017 and exploding in 2022.
- **Ethereum**: The second most popular and second-largest cryptocurrency by market capitalization is Ethereum. Released in 2015, it stood out among over a thousand other cryptocurrencies due to its unique feature of smart contracts. We’ll talk more about Ethereum in detail in the next section
- **Tether**: Tether is unique in that its value is fixed to that of the US Dollar. Such a cryptocurrency is called a stablecoin. This may attract some traders who are concerned with the volatile nature of other currencies that tend to rise and fall substantially over a short period. However, Tether’s main function is that of a medium when traders wish to move from one cryptocurrency to another.
- **Binance Coin**: Binance is the 3rd largest cryptocurrency by the price of an individual coin and the 4th largest overall by market capitalization. It is issued and managed by Binance, the largest cryptocurrency trading exchange in the world. Although it can be used for purchasing a variety of goods and services, it has been banned in some countries.
- **USDC**: USD Coin is another example of a stablecoin whose value is fixed to that of the US Dollar. However, unlike Tether, it is claimed to be fully backed by dollars held in reserve, which are also regulated by US institutions. This makes it seem safer and more reliable than its alternatives.

### Ethereum
We talked a bit about Ethereum above, but let’s look at everything this cryptocurrency offers. Ethereum was conceived in 2013 and released in 2015. This is relatively late, compared to other early currencies like Bitcoin. However, it has still achieved massive success in a short time, owing to its unique ability to offer a wide range of functions across a variety of applications.

**Cryptocurrency**: To make it easier to distinguish between the technology and the actual currency itself, the former is called Ethereum while the latter is called ether. Therefore, ether can be used to pay for goods and services, provided it is accepted in that particular market. To do so, you require a digital wallet, which generally represents the address to which your money is tied.

**Smart contracts**: A smart contract is generally just a program that automatically runs when a contract’s conditions are met. They can also be classified as a type of Ethereum account, ones that have a balance and can send transactions over the network. However, they are not individually controlled. Rather they strictly adhere to the code and run as programmed.

**Decentralized applications**: Unlike regular mobile apps that function on centralized servers that belong to and are operated by particular companies, decentralized applications (dApp) run on a peer-to-peer (P2P) network that is based on a blockchain. Ethereum powers these apps to perform tasks, much like a regular app, such as playing games, investing, performing transactions, or making use of certain services that you regularly would.

**NFTs**: Non-Fungible Tokens (NFTs) are unique, and therefore non-interchangeable, tokens or units of data that are tied to and represent certain digital assets. These tokens are stored on a digital ledger using blockchain technology, the same as Ethereum or other cryptocurrencies. Therefore, NFTs can increase or decrease in value and can be traded on the market. The value of NFTs is directly tied to the perceived value of the audio, video, or image files that they represent.

**DeFi**: Decentralized Finance (DeFi) comprises a variety of financial applications and instruments that ‌compete with legacy digital payment methods. It is aimed at removing middlemen and financial intermediaries that are commonplace in centralized systems. DeFi also makes use of smart contracts. This is the reason ‌most decentralized finance applications are built on top of Ethereum.

### Benefits of Web3 authentication to ASP.NET
Now, let’s consider a situation where you want to use your Ethereum account as user credentials to log into a decentralized ASP.NET app. The idea is to issue a JWT token in exchange for the user’s credentials.

However, instead of forcing the user to make a transaction, we could instead require them to sign a text message using their private key. Web3 authentication allows you to do this. Take note that, for this to work, you need to be signed in to your account.

**The benefits of this method are:**
- **No transaction required**: Using web3 authentication means the user won’t have to make a transaction every time they want to log in to the ASP.NET app. Therefore, this saves them resources that would otherwise be wasted just for performing a simple authentication process.
- **Faster authentication**: The user doesn’t have to wait long for the authentication process to complete. All they have to do is click a single button while logged into their Ethereum account.
- **Privacy**: If users are forced to perform a transaction to log into their ASP.NET dApps, their login operations become permanently public and part of the Ethereum blockchain. This is not the case with Web3 logins, which also indirectly reduces the overall size of the cryptocurrency.
- **Simple-to-use**: Another benefit of Web3 auth is that it doesn’t need you to enter your ASP.NET app’s username and password or use an external authentication service. Instead, it is the same mechanism used to log you into your Ethereum account, making it safe and easy.

### Tokens for securing REST APIs
The JWT (JSON Web Token) is an open standard extension of OAuth 2.0 for creating access tokens that assert certain claims.

JWTs can be used in a variety of different scenarios, compared to API keys and OAuth tokens that are always used to access APIs. One reason for this is that it can store just about any type of data. It, therefore, excels in combination with OAuth

**Functions of a JSON Web Token:**
- Authentication: When a user logs in, a JWT is returned and stored in local storage or as a cookie. This is the most common function of a JSON Web Token. It is similar to how a JWT will be used to authenticate a user after they log into their Ethereum account.
- Information transfer: JWTs can do more than just authenticate a user. They can securely transmit information between two endpoints. This is the other part of our use case that’s relevant. Since we require the user to sign a text message using their private key, the token can carry this information as well and allow the user to get authenticated.

### Additional Sources
- [Web3 Wallet login & NFT-based restriction](https://plugins.miniorange.com/web3-wordpress-login)
- [Single Sign-On (SSO) into Shopify using Web3/Crypto Wallets](https://plugins.miniorange.com/web3-sso-shopify)

How to secure ASP.NET with your Ethereum account


## Convert WordPress Site to Android Application

### WHAT IS WORDPRESS REST API AND WHAT ARE THE ADVANTAGES OF REST? {#what-is-wordpress-rest-api} {#what-are-the-advantages-of-rest}

WordPress REST API is a set of instructions used to access your WordPress website from outside of the WordPress installation which you can use to convert WordPress website to android application or any other platform application. WordPress REST API allows you to access the WordPress site resources like pages, posts, etc from your mobile application.


APIs act as a mediator between Resources (database) and user (UI). API fetches data from the database and shows it to the user.


REST stands for Representational State Transfer. REST is a architectural style for an API and an application is RESTful only if it stands on these 5 principles:

**1) Uniform interface** : Application must have a uniform interface between components so that there is a standard form for the transfer  of information.

**2) Client-server** : There has to be client-server and resourcer involved and the requests should be sent over HTTP.

**3) Stateless** : This means that no user (client) data is stored on the server between 2 GET requests and every request is independent of each other.

**4) Cacheable** : The data should be cacheable so that client-server interactions are streamlined.

**5) Layered system** : This is to ensure the entire system is secure, load, balanced and that the entire system is not visible to the client.



WordPress REST API lets you to interact with WordPress from outside of WordPress, be it a mobile application or desktop application.In brief, we can say that a third-party website or a mobile app can access your WordPress database and perform operations such as fetching data from it and adding data to wp database. WordPress REST api changed WordPress from CMS to an application platform. 

![rest-api-flow](/blog/assets/2023/rest-api-flow.webp)

Suppose you have a website (like WooCommerce, LearnDash, etc) on WordPress and you want to have a mobile application that will use the same resources/ database used by your WordPress site, so you need something that can facilitate this without hurting the integrity of your WordPress site. For this purpose our WordPress REST API can be used which will allow you to integrate your WordPress website and android / iOS mobile application. REST API will allow you to convert WordPress site to mobile app by utilizing the WordPress site resources and exchange data in the form of JSON (JavaScript Object Notation).  You can also use WordPress REST API to Login and get user data on your mobile application.WordPress REST API will convert your woocommerce site into an android application.



REST API provides functions that will allow you to fetch data from WordPress sites onto your mobile application.
![rest-functions](/blog/assets/2023/rest-functions.webp)

### CONVERT WORDPRESS WEBSITE TO ANDROID APP {#convert-wordpress-website-to-android-app}

**1) Related Topic** – Build a mobile app with WordPress REST APIs, How to make more out of WordPress Rest API by doing less

![rest-api-authentication-plugin](/blog/assets/2023/rest-api-authentication-plugin.webp)

If you have a WordPress website for your company and now you want to have a mobile (android/iOS) app so that  your customers would be able to choose between your website or mobile application so that your users will be able to have a seamless experience. Research shows that 51% of users search for products online, so if you create a mobile application for your website, you will definitely get an edge over your competitors.

 **2) WordPress data fetch for displaying on mobile application**: With WordPress REST API you can fetch posts, pages from your wp website to display on your mobile (android/iOS) application with various authentication options present in our plugin. If you want to login into WordPress site on your mobile app, you can use the WordPress username/password and access the wp database easily by rest api login which will authenticate the credentials before giving access to the database.

**3) User Register sync**: If a user registers on the mobile application of your WordPress site, he will be eligible to login on your WordPress website also and vice versa. The data generated on your WordPress site or mobile app will remain synchronized. So the integrity and consistency of your site’s data is maintained without any compromise on security.

**4) Syncing and Securing data flow from third party plugins on your website**: If your website is using third party plugins like Woocommerce, Learndash, Buddypress, Gravity forms etc, that data can also be synced between your mobile and WordPress application with our secure and protected authentication methods making sure nothing is compromised.

**5) Login into mobile app using WordPress credentials**: With the help of our Rest API Authentication plugin’s WordPress login API, you can authenticate/validate your user login into mobile application. Suppose you have a WordPress site and you have now created a mobile app (android/iOS) which has a user login for where user puts in his username/password, REST API will allow you to authenticate the user by checking the credentials on WordPress database and send a successful message on validation and show an error if the credentials are invalid.

**6) Woocommerce site into mobile app**: If you have a WooCommerce site and now you want to create an android app for the same store so that same products list, user details are accessed and maintained, so Rest API will allow you to authenticate Woocommerce API on mobile application and synchronize your inventory between mobile and WordPress installation. It can also keep track of user carts across devices. Let’s say you have a woocommerce site built on WordPress where you have all your products listed and you want to create a mobile (android/iOS) application from where your users can login and order products as listed on your woocommerce site, REST api will allow you to synchronize and share data between your WordPress site and mobile app. You will be able to access your woocommerce rest api in your mobile application and you also will be able to login into it with WordPress credentials.

**7) LearnDash** : Learndash is a blessing if you have to impart e-learning in universities, small to midsize companies, startups, etc. REST API allows you to secure / protect your access to Learndash user profiles, courses, groups & many more APIs across WordPress installation and android application. If you have a learndash site on WordPress and you want your courses to be accessible on your mobile (android/iOS) application, you can use REST API to fetch and synchronize data with your WordPress database.

**8) Webview access on mobile**: If you have a website on WordPress and you want to create an application for mobile device which will access the same resources as your WordPress site, you can use WordPress api to access the wp site on mobile phone with webview. It means you will have a mobile app for your WordPress site using WordPress rest API.

**9) Custom API Endpoints in the WordPress REST API**: Suppose you want to access custom data on your WordPress site on your mobile application, so we have a plugin [“Custom API for WordPress”](https://plugins.miniorange.com/custom-api-for-wordpress) which can allow you to define your custom endpoints /REST api routes and also it has easy-to-use graphical interface where you can put custom SQL queries as well.


### IS REST API SECURE? {#is-rest-api-secure?}

![rest-api-secure](/blog/assets/2023/rest-api-secure.webp)
By default WordPress endpoints are insecure. Hackers can easily send requests to your WordPress API and get access to your Posts, Post, Revisions, Categories, Tags etc, and can perform CRUD operations easily on your website. The default REST api connection is not encrypted and can be easily viewed in JSON format. REST api is a door to a lot of opportunities but if left unattended and insecure, then this door of opportunities will turn into a disaster for your website and user data. So by adding our [WordPress REST API AUTHENTICATION](https://plugins.miniorange.com/wordpress-rest-api-authentication) to your WordPress/ woocommerce website your endpoints won’t be unprotected. Our plugin will let you set various API authentication methods according to your needs and requirements.

Letting a client application (android mobile application) to manipulate data on your data resource by allowing access through API is secure with our [WordPress REST API AUTHENTICATION](https://plugins.miniorange.com/wordpress-rest-api-authentication) plugin allows you to make calls to your WordPress site from android mobile application without compromising the security of your website. Our plugin will make sure that only authenticated users are allowed to access your site data and will protect your WordPress database throughout. We have various authentication methods in our plugin to  make sure that your WordPress website is protected and secure. 


### REST API AUTHENTICATION BEST PRACTICES. {#rest-api-authentication-best-practices}

 - [Basic Authentication](https://plugins.miniorange.com/wordpress-rest-api-basic-authentication-method)

    This is basic authentication method to protect your WordPress endpoints by following methods:
    * Username:Password : This method for Basic Authentication authenticates the REST APIs by using username and passwords in the authorization header with the form of base64 encoded or with highly secure HMAC encryption.
    * Client-ID:Client-Secret : This method for Basic Authentication authenticates/protects the REST APIs by using client credentials provided by the plugin in the authorization header with the form of base64 encoded or highly secure HMAC encryption.

    
![basic-authentication](/blog/assets/2023/basic-authentication.webp)
    
   - [API Key Authentication](https://plugins.miniorange.com/rest-api-key-authentication-method#step_a)

    It allows you to secure WordPress endpoints without exposing user credentials as the plugin generates an API key for accessing any resource which can also be regenerated in the plugin UI.
   - [JWT Authentication](https://plugins.miniorange.com/wordpress-rest-api-jwt-authentication-method#step_a1)

    WordPress REST API Authentication itself issues the JWT token and works as an API Authenticator to protect your REST APIs. The plugin itself provides the REST API endpoint through which you can generate the JWT token very easily by passing the valid WordPress user credentials.
   - [OAuth 2.0 Authentication](https://plugins.miniorange.com/wordpress-rest-api-oauth-2-0-authentication-method#step_a)

    If you don’t have a third-party identity provider, then in this case WordPress REST API Authentication works as both OAuth Server(Provider) and API Authenticator to protect your REST APIs. It is the most secure method to authenticate the WordPress REST API endpoints.
    * Password Grant : If you want to fetch user specific content from the database then this method is useful.
    * Client Credentials Grant: This method uses the OAuth 2.0 protocol with Client Credentials grant to authenticate the WP REST API endpoints to use services which call APIs without users.
   - [Third Party Provider Authentication](https://plugins.miniorange.com/wordpress-rest-api-authentication-using-third-party-provider#step_a)

    if you are already using an external OAuth/OpenID Connect (Identity provider) which provides you with an access token/id token or a JWT token, then that token can be used to authenticate the WordPress REST APIs and the plugin will validate the token directly from these token providers and only on successful validation, API endpoints are allowed to access.
