title: Best way to secure javascript front end/REST back end architecture web site?
body: <p>I would like to build the following project:</p>
  
  <ul>
  <li>public REST API back end which can be accessed by any authenticated client</li>
  <li>front end with static files in HTML/CSS/Javascript with Backbone.js jQuery calls to the REST back end</li>
  </ul>
  
  <p>In fact, there are three parties in my architecture : the front end, which is a client of the back end, the back end and the user which wants to authenticate on the front end login page.</p>
  
  <p>What is the best way to secure the three parties involved in this architecture ?</p>
  
  <p>In fact, I believe it is just impossible to do a secure app on the front end if I do everything in javascript, so I intend to delegate the authentication/authorization to a proxy layer on my server front end. What do you think about that ?</p>
  
  <p>I intend to use OAuth to secure my REST back end, but I am not sure if I have to use the 2 or 3 legged implementation. What is the right approach in this case?</p>
  
  <p><strong>UPDATE</strong> : while searching a deep more on SO website, i found this <a href="https://stackoverflow.com/questions/4574868/securing-my-rest-api-with-oauth-while-still-allowing-authentication-via-third-pa">thread</a> which is exactly what i would like to do, except i want to use Java on server side and not DotNet. If i understand well, in fact my web site is like any client of my REST API, except it is the only one which has the right to create new users' accounts. Because, if my REST API is only accessible by OAuth (like Twitter's one), who can perform the user account creation before ? Am i right ?</p>