Re:Introduction to ASP.NET Web API
by jinushaun on Monday April 02, 2012 @08:03AM
(#3787616)
I know this is still a new API, but I really wish there were more in-depth tutorials based on real world use cases. Namely everyone seems to gloss over authentication and cross domain login. Instead of a true publicly accessible independent API, everyone seems to build the website and Web API in the same project. They're one and the same!
[ Parent
| on HN ]
Agreed. Getting authentication right when hosting your API on a different subdomain is difficult. You can write an HTTP handler to implement CORS but it's less than optimal if you also want to support Ajax within your app, in addition to normal API usage.
As an alternative, you can implement your API in a different project and host it on a virtual path (e.g., /api). This solves the auth problem, but it poses difficulties under IIS. In particular, your Web.config inherits from the parent Web.config, so sections can be clobbered.
Ultimately, it's easiest to just host your app and your API in the same project. You can implement forms auth (or roll your own cookie auth) so your Ajax requests Just Work (TM) and then implement separate auth (like Basic Auth or OAuth) on just the API controllers to support real API usage.