So the thing is I have created a Asp.Net web api and am using oauth to secure the access.
The problem is that the clients want to make a pure html(angular) website from which they will access the api. So basically they will call my webservice oauth endpoint using their credentials to get the token and refresh token and they will store that somewhere in the localstorage to make subsequent request. My problem is that if they will use pure html and angular, their call to the api and point and request data will be visible to a malicious user and he can use that client id and password to generate tokens and can use that for his use.
I searched a lot and didn't find any help . Since it is my first web api project, I don't lot about these. Can any one help me regarding this ?

1 Answer 1


Your use-case is the public client as described in RFC 6749 Section 2.1. In this case you have the option to implement the implicit grant. This implies that the user interacts with your site to grant access to the data.

However if your use-case forbids the redirection of the user the OAuth framework can't solve your problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .