This might be the first of x number of post asking security related questions with a web api service. So i've created a Web-Api based service (hosted in IIS) that returns JSON data. Currently the JSON Service will only be used by a different web application (but on the same IIS Instance) on the same server. Its possible they could reside on the different servers (or even azure in the future but that is a more long term view).
At first i thought about securing the web-api service using Windows Authenticaiton. I could add security to the AppPoolIdentity account that the application pool for the web site (client) is running under. This would probably work i think but we already have an item pretty high in our product backlog to AJAXify the site. So i will have to feed the JSON to the client somehow. This is really where my questions come from. Not quite sure how to do it securely. I thought about using the web site (client) somewhat like a proxy which means they would alw ...
Go to the complete details ...