I have this web API project which handle all database access via entity framework.

I have another web client reside in DMZ to call those APIs (via ajax or c#) in the web API project.

When I make API call via c#, models passing between web client and web API are the same.

For web API, the model is generate by entity framework (database first).

For web client, I create a model class.

Now when I change\update the table in database, I can easily update the model in web API via entity framework but I have to manually update the model class in web client.

It's easy when I only have a few models to maintain, not when I have a lot of models.

Should i separate them just for the sake of separation or I can just ask web client to reference web API and just use those models generate by entity framework?

Are there any security concern if I ask web client to reference web API project?

How should I manage models between web client and web API in this situation?


Yes you should split them.


  • Security and Privacy
  • Backwards Compatibility

Security and Privacy

Imagine that you have a User and that user has a password:

  • do you wish to return that password when you return the user?
  • How about when you return a list of users?
  • Should you return that password to a User who is not the requested User?

The answer is NO to all of those questions.

Now you have a mismatch:

  • The User that is stored in the database Must have a password.
  • The User that is received on signup, sign in, or password change Must have a password.
  • The User that is received at any other time Must Not have a password.
  • The User that is returned Must Not have a password.

Backwards Compatibility

Imagine a scenario where you have an application that other people install on their own machines and they pay you money for that application to work. They will not like being forced to upgrade just because you released a feature, particularly if you want more money for it.

But your new clients want that feature, and will upgrade. How do you serve the needs of both groups?

The answer is to version the models used by your api (ie. v1, v2, v3, ...). This allows some clients to use v1 models while others are using v2 models. It will be the job of the API to map both sets of models onto the models used in the persistence layer.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.