REST session workflow for creating users

Question

I am working on a C# WebApi/MVC project that has a rather large workflow process for creating a user and placing in their required information. There is about 10 major steps involved, in which it could technically take a user hours to fill out.

The first step takes standard basic information such as username, password, email, name, address etc.

What I would like to do is after this first step is successful, send a rest call that will create the basic user in the user table, and then prepare a session for the further steps in which when any field is filled out in the next steps, it will automatically send an ajax call and update the field in the database.

While this all sounds easy and simple in theory with the use of sessions, which I could do in MVC, I want to do this in WebApi with REST in which REST is supposed to be STATELESS.

Has anyone come across similar issues, and if so what do they recommend as an approach? The options I can currently think of are:

-Ditch the REST for standard MVC for this process and leave WebAPI for only Reads instead of Writes as the only Write process is the inital creation of users/accounts.

-Using Authentication tokens? But can this handle this process successfully?

-Once the user is created, take the username/password for every REST call as the auth to the WebAPI? Store the User/Password in MVC session and directly call the API from MVC, mobile applications would just store the username/password in the application and call the WebAPI (I think this is the most appropriate)

Can anyone tell me if any of those options are the best practice, or does anyone have a better best practice/process for these things? I would prefer to write things once to cover Web and Mobile as much as possible rather than having to duplicate processes.

Thanks in advance!!!

Answer 1

I would consider to modify regular WebAPI OWIN register flow.

1. Collect basic user info and post to Web API via Ajax. If succeeded - send OWIN token back to the caller in HTTP header.
2. Proceed to extra steps for user info updates (via HTTP PUT for example) and put the token in authenticate header. Mark WebAPI update procedure with Authorize attribute.

This blog post could help to setup WebAPI to issue and accept bearer tokens.