I realize how basic this question is, but I have relied for years on mechanisms built into .NET to handle log in for me. These days, most of my work involves using client-side logic and calling API services and I am now considering authenticating users that way.

Should I be using oAuth, or is there something more simple? I am using salting and key stretching on the server-side, but I don't know how to protect passwords and other credentials while they are en route to the server from the client.

1 Answer 1


To protect credentials in-transit, you use HTTPS. That is sufficient. As long as your form is delivered over HTTPS and submitted over HTTPS, everything sent and received is thoroughly protected.

As for what to use as a backend, that's up to you. Using oAuth effectively kicks the can down the road to someone else. Now you're not responsible for storing credentials, Facebook is. If instead you need to store credentials yourself, the common key-stretching answer applies.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .