I am developing a middle-ware web service app (REST) using ASP.net MVC-4 web API.

The rest services are consumed by android, ios, angularjs client apps. The same user is able to use multiple platforms at the same time.

Can anyone advise me which is the best protocol for my purpose? I read articles about JWT, HMAC, auth, auth-2 protocols, but I am not able to take the right decision.

closed as too broad by schroeder Sep 11 '18 at 13:55

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


JWTs are a good way to approach this. My two cents would be to sanitize any and all user input on the client side (reduces surface area for XSS attacks), and use cookies as a medium for transporting the token between client and server. Set the token expiration times to something where, even if it gets stolen, it won't be useful for long. You can lookup XSS prevention cheat sheets which will provide more information regarding XSS prevention. And finally, if this is a production level app, have it pentested or scanned by a tool like Mozilla Observatory. Hope this helps.


You should use the new .NET Core technologies from Microsoft. Then you have Attributes from ASP.NET Core Identity. In your controller for example you just write a [HTTPS] attribute before for encryption etc... Take a look at David Roth's REST-API securing Video with .NET Core on, I think Channel 9.

You should use this because Microsoft wants a reboot of their web technologies. New Entity Framework Core instead of ADO.NET, new Routing mechanisms (with attributes), Dependency Injection Strategy Pattern by default, cross-platform compatibility in your apps, the possibility to run hand in hand with docker (Microservices which runs in separate docker containers) and, and, and... long story short: take a look at .NET Core and .NET Core Identity for securing the api.

And in 2019 with .NET Core version 3 comes also a GUI. WinForms and even WPF. Sadly there is up to now not something like "general XAML" but Microsoft is exactly working on this.

Not the answer you're looking for? Browse other questions tagged or ask your own question.