I would like to build the following project:
- public REST API back end which can be accessed by any authenticated client.
In fact, there are three parties in my architecture : the front end, which is a client of the back end, the back end and the user which wants to authenticate on the front end login page.
What is the best way to secure the three parties involved in this architecture?
My problem is I don't know how to perform this workflow with OAuth :
- a user wants to create an account on the Front end.
- the Front end delegate the account creation to the REST back end.
- the back end create the account and send an ack to the front.
- then the user can perform calls which require authorization.
And I also want my REST back end be accessible to any other third party application whith OAuth.
Will I have to use 2-legged or 3-legged OAuth on the REST back end?
Can I consider my Front end just like a special third party application which has the ability to create user account ?
What security protocol may I have to use on Front end ?