# SPA with .Net backend - best practises?

**URL:** <https://devforum.okta.com/t/spa-with-net-backend-best-practises/3735>\
**Category:** Questions\
**Created:** [December 21, 2018, 1:59pm UTC](https://devforum.okta.com/t/spa-with-net-backend-best-practises/3735 "2018-12-21T13:59:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![smartin](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@smartin](https://devforum.okta.com/u/smartin)\
**Post date:** [December 21, 2018, 1:59pm UTC](https://devforum.okta.com/t/spa-with-net-backend-best-practises/3735/1 "2018-12-21T13:59:33Z")

</div>

I am tasked with setting up Okta for a project with has a .Net WebAPI backend and the front end being a react (JS) SPA.

What is the best practise for this scenario? Should I use JWT and drive authentication from the client side? Or is it better to have the client side submit login information to the .Net backend, and perform the authentication from the server side?

~Shea M

---

<div class="post-metadata">

**Author:** ![nate.barbettini](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/nate.barbettini/32/385_2.png) [@nate.barbettini](https://devforum.okta.com/u/nate.barbettini)\
**Post date:** [December 21, 2018, 4:19pm UTC](https://devforum.okta.com/t/spa-with-net-backend-best-practises/3735/2 "2018-12-21T16:19:18Z")

</div>

The best way is to get tokens directly in your client, and attach them to outgoing AJAX requests. Then, your backend must validate those tokens on each incoming call. We have some samples of exactly this!

Quickstart for ASP .NET + Vue.js: [https://developer.okta.com/quickstart/#/vue/dotnet/aspnet4](https://developer.okta.com/quickstart/#/vue/dotnet/aspnet4)

Web API (also called a “resource server”) example project: [https://github.com/okta/samples-aspnet/tree/master/resource-server](https://github.com/okta/samples-aspnet/tree/master/resource-server)  
Vue.js SPA: [https://github.com/okta/samples-js-vue/tree/master/okta-hosted-login](https://github.com/okta/samples-js-vue/tree/master/okta-hosted-login)

Hope this helps!

---

<div class="post-metadata">

**Author:** ![smartin](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@smartin](https://devforum.okta.com/u/smartin)\
**Post date:** [December 28, 2018, 4:28pm UTC](https://devforum.okta.com/t/spa-with-net-backend-best-practises/3735/3 "2018-12-28T16:28:17Z")

</div>

Thanks Nate, I will checkout those examples.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 13, 2024, 12:14am UTC](https://devforum.okta.com/t/spa-with-net-backend-best-practises/3735/4 "2024-01-13T00:14:59Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.