I am working on an ASP.NET MVC web application, which fetches its data from an API in the back. So authentication is currently done via ASP.NET Forms Authentication, which means the client sends email and password to the website, the website transfers that data to the API which returns an authentication token, which is stored within an ASP.NET session. After that the auth cookie is set on the client.
That's okay and secure (from my current knowledge), no credentials nor the token is stored on the client side.
As a drawback, every AJAX request has to be routed trough the website. As a result, I have a large number of ASP.NET MVC actions, which don't do anything but forward the request to the API and return the result coming back from there.
That may be a bottle neck in the future, because the website infrastructure has to be scaled in the same way the api infrastructure has to be. Now I am looking for a solution to remove these redundant calls via website and go directly to the API from the client (via AJAX).
That requires API authentication from the client. That wouldn't be a problem, technically, if I store the authentication token in LocalStorage (old browsers are not supported).
But how secure is that approach? What options exist for stealing the token, next to JSONP (which can be prevented by not including external scripts, right?)?