title: Security in WebAPI App with MVC Client OpenID / OAuth
body: <p>I know there is a lot of questions out there already and I've been reading blogs and looking at samples for well over a week and I'm still a little hazy on how some of this is going to work in the real world.  The samples are very helpful, some are very complex some are simple, none have really clarified some of my questions.</p>
  
  <p>The system comprises:</p>
  
  <ul>
  <li>Web App (own IIS site, with SSL, consumes Public API)</li>
  <li>Public API (own IIS site, with SSL)</li>
  <li>Desktop Widget</li>
  <li>Mobile (iOS, Android)</li>
  <li>3rd Party apps</li>
  </ul>
  
  <p>How best to handle user registration and account creation?  Whilst offering OpenID there also needs to be a 'local' login to the web application.  Having a method on the API that accepts base data types (strings/dates etc...) values and then creates an account is asking for trouble and a red flag to the spammers.  Would it be best to handle this exclusively through the web site employing visual CAPTCHA checks?  How does the Facebook mobile app handle this registration scenario?</p>
  
  <p>Lots of samples also seem to use small subsets of the default Forms Authentication database for Membership. They then use Entity Framework and the Membership, WebSecurity or FormsAuthentication, Roles Provider classes in various different ways depending on use case.  Are there any alternatives to this approach to consider for the security backend?  Our DB guy is considering rolling our own but then we also need to build our own user management app :(</p>
  
  <p>Once a user is registered and logged in to the web app I can't see any way around continuing to authenticate and authorize each call on the WebAPI.  I'm assuming at the moment that the API should just implement OAuth and treat the web app as another client app like the mobile app and 3rd party apps.</p>
  
  <p>I think I've read too much without playing with code to settle this in my head.  There are so many approaches.</p>
  
  <p>TIA,</p>