title: How to implement the same authentication mechanism for both the asp.net mvc and web API
body: <p>Goal is to create an api that can be shared by native mobile devices (ios, android, win phone) as well as web applications with various presentation layers (asp.net core MVC, angular).</p>
  
  <p>Planning on using asp.net core web api for implementing a REST api that will be used by the mobile clients as well as javascript clients.  My question is since other presentation layers like asp.net MVC will be used where ideally should security logic be placed?  If we add the checks in the REST api then the asp.net MVC application controllers would have to call the REST web api using HttpClient instead of just referencing the business layer (shared class library).  </p>
  
  <p>The authentication of each application will be handled by json web tokens as they are mobile friendly and can scale easily. So my question is really about the authorization security and where it lives. </p>
  
  <p>Option 1:</p>
  
  <p>web api (security lives here) > business/service layer > data access layer > data layer  </p>
  
  <p>Option 2:
  web api > business/service layer (security lives here) > data access layer > data layer  </p>
  
  <p>In option 1 this is fine for mobile and client front-ends as they have to call the REST api, but the asp.net core MVC would have to use HttpClient to call the REST api instead of calling the shared class library that makes up the buinsess/service layer.</p>
  
  <p>In option 2 all the REST api is responsible for is to call into the business/service layer where the security is handled there.</p>