I need to audit modification actions (create/delete/update) in an enterprise web application. Then the user may need to see history of changes of a specific entity (a Person for example) to decide to do an action or not.
As far as I know it can be done into application by using libraries like log4net, nlog,... in .NET or maybe there are other libraries special for versioning which I don't know.
Or it can be done in database for example using Change Data Capture of SQL Server.
Using built in database solutions seems more efficient but the question is:
Is it correct in terms of software engineering to control business of application into Database?
What version and edition of SQL Server are you using? SQL Server 2008 + support auditing natively, this is an Enterprise Edition feature in 2008 and 2008 R2 I believe, but server level auditing is available in the standard edition of SQL Server 2012 with only database level audits being an enterprise feature.
See the following link for details:
SQL Server Audit (Database Engine)
Change data capture isn't really designed for auditing, it's meant to be used for providing a summary of data that has changed on a source system so that it can be easily consumed by another system.
EDIT:
So, if you need to keep the actual data that has changed, then CDC can do this, but you won't be able to see who changed it, so it is not an audit. A combination of CDC and auditing could work, but would be complicated to set up.
The easiest way would probably be to maintain a history table using triggers for update, insert and delete, adding the audit information such as when the modification took place and who performed the action. This would also mean that you would not have to use an enterprise edition of SQL server as triggers can be defined on all editions.