Reputation: 6510
I understand and appreciate the value ASP.Net MVC 4 Web API brings for Web Clients (when combined with Knockout, jQuery). However, I am not sure how this works for internal web services on the server side. Moving away from Web API is not an option.
My requirement is that I call the same service from jQuery and also for some of the calls I need in the ASP.Net MVC controller (on the UI) that should not be accessible by JavaScript clients.
I chanced upon Dave's this post: http://encosia.com/rest-vs-rpc-in-asp-net-web-api-who-cares-it-does-both/. I understood that what I needed was a RPC style (I'm used to WCF) and Web API supports it.
This is an Azure application so I can secure it using ACS in this article.
I can probably secure the calls I need (may be a separate API controller) by restricting the calls to my servers (URL).
Thanks in advance
Upvotes: 3
Views: 2574
Reputation: 81700
In your case, I can see that ASP.NET Web API sits at presentation layer. Since ASP.NET MVC is also at presentation layer then it probably does not make sense for MVC to call Web API.
A simple approach (and I always advocate KISS) is for having a business layer that is equally accessible from both MVC and Web API. So instead of MVC going to Web API and then to BL, it goes directly.
However, if you are designing an SOA Web API facade that encapsulates a context boundary and can be used equally by clients and MVC, I suggest you use Authorization to control who can access what. This could be OAuth, or any other scheme.
Upvotes: 2