0

Suppose I am designing a web application and also building a Web API with authentication via Kerberos/NTLM. The Web API is first for my app, but I imagine I want to make it general-purpose. My instinct is to create the Web API as its own separate solution, and then consume it with XHR requests in my web app. So perhaps I have the API hosted at fooapi.mysite.com, and the browser-usable app is hosted at foo.mysite.com.

Should I thus enable CORS to allow for this? Wouldn't I have to specify CORS origins for every consumer? Or must I instead reproduce the API calls on my app, say under foo.mysite.com/api? If the latter, is there a smart way to do so in ASP.NET without fully writing a second Web API?

Or do I have a wrong approach and I should stick to a application-specific Web API?

What is common practice for the scenario of wanting to make an API mainly for one site but consumable by others too? Do I commit to CORS or do I need app-specific APIs?

6
  • There's something missing from your question, as it is already possible to use any ordinary Web API in any application, regardless of the domain. Perhaps you really meant "a secured Web API," or "an API over SSL?" Apr 17, 2018 at 20:20
  • Or perhaps you are running into cross-site javascript problems (aka CORS)? Apr 17, 2018 at 20:22
  • Won't the browser block all CORS requests? Apr 17, 2018 at 22:44
  • CORS stands for Cross-Origin Resource Sharing. It specifies how you can make a cross-domain request succeed, not how you can block it. Read developer.mozilla.org/en-US/docs/Web/HTTP/CORS Apr 18, 2018 at 1:39
  • Right. My understanding is that CORS is needed to allow for one site to call another's API, My question is should I do this, or do I need to make a site specific API instead? What is common practice for the scenario of wanting to make an API mainly for one site but consumable by others too? Apr 18, 2018 at 3:32

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.