Hi,
I'm trying to get my head around using OAuth to protect a web API and whether it is the right solution for my scenario, and was wondering if anyone here could give me some comments on the proposed approach as well as where I can get more information.
The scenario:
I want to create an online service consisting of a website which talks to a business layer which in turn talks to SQL server via EF. I also want to expose a Web API. Classically I would have written the business layer in WCF, exposed one or more end points
onto the internet, and made partners use SOAP clients to talk to the API. As my service would have its own database of users I would go down the route of Basic HTTP authentication over SSL for API users, and forms auth for the website. The connection between
the website and business layer would not necessarily be SSL but would be a LAN based endpoint and not exposed to the internet. Some authentication trickery would allow the website to ...
Go to the complete details ...