search

IdentityServer / IdentityServer4

OpenID Connect and OAuth 2.0 Framework for ASP.NET Core
https://identityserver.io
Apache License 2.0
9.23k stars 4.02k forks source link

IdentityServer4 in Web Server or App Server? #5489

Closed gcwei closed 1 year ago

gcwei commented 1 year ago

I have a web application hosted in the web server, and I am hoping to use the identity server to do login using OpenIdConnect.

Should Identity Server be hosted in the web server (DMZ) or app server, if the web application is assessible in the internet? I am guessing it should be hosted in the web server? since my web application redirect the request to identity server.

Due to security reason, I need to put the identity server in the app server because it's touching the DB. Is there any work around other than using old method of Login API?

Thanks.