I am experienced with developing SharePoint 2007 and 2010 solutions, and am working to get into SharePoint 2013 development.
The requirement from our customer is that the App can only be deployed as an auto-hoted or SharePoint-hosted (no Provider-hosting) app.
My impression is that it pretty much limits you to HTML/CSS/Javascript. Most of our current 2010 solution can be ported to frontend code without much of a hassle, but we do have one major issue.
We provide a platform and each of our customer is issued one or more sets of credentials for use with OAuth authentication. This allows us them to generate limited tokens for each user visiting, without giving them permanent access.
Since everything is client-side, I don't see any way to "hide" these credentials from the user. What is the best practice in situations like this? It would be a tiny bit of server-side code to generate tokens, but I don't want to put the OAuth credentials in the front-end code for the users to (ab)use.
The individual users do not have access to our API or services (the idea behind giving them these master credentials is that they don't have to create/connect each user to our system, and unfortunately we don't have direct AD integration or similar).
Is this even possible? Can the user send anything to us directly that would allow us to verify them as being part of a specific SharePoint site?
