I have a web ui application written in Angular 4 running behind IIS with SSL required and one-to-one client certificate mapping.
This SSL web ui application calls a .net core API project that also uses SignalR to push it's data to the ui app.
These run off two different URL's under the same domain.
https://ui.mysite.com
https://api.mysite.com
Both applications are NOT available to the public and require good security.
I'm comfortable with locking the ui site via individual certificates. The SSL certificate is via a trusted certificate authority and then create self-signed certificates for client authentication.
What would you suggest to lock down the api site to the outside world so that only the ui site (and internal developers inside our network for debugging purposes i.e. looking at json responses) can access?
I've seen people mention oauth2 / jwt? Any examples?
The only people that require access are people within our company but on devices that may not be connected to our internal network i.e. mobile phones or laptops when travelling.