I would like to use my API website for authentication & authorisation of users and ideally keep my UI site purely static content (html, js, css). I have configured ServiceStack's OAuth & OpenId (and credential/basic) providers, so they answer to api.mysite.com/auth/{provider} requests

I would like to be able to users of www.mysite.com to be able to authenticate and then make calls to the API site via ajax.

The BootstrapApi example project - although very useful - demonstrates the API & website running on the same domain.

  • Is this possible/secure with a static javascript client?
  • Could I share a cookie between sub-domains?
  • Could I return the access token to the client and have use it to calculate an Authorization header before each request?
ajax oauth servicestack
Edit
Report