Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and am looking for a solution that is "good enough" to get the app usable without sending plaintext over the wire.

The app is built on .NET Web API and serves JSON to HTML/JS SPA clients. Eventually the clients will require their own API keys.

For now, I need to allow users to securely login and register using a username/password from these clients.

I began to implement Basic Authentication per Chapter 8 "Knowledge Factors" in the above mentioned book because of the simplicity, however it seems like this forces the clients to use a browser dialog to collect credentials, instead of collecting from a form.

Is there any way to get around this and use a form? If not, what would you suggest as an alternative security solution?

I was considering Forms Authentication but I'm not sure what the pros/cons are in the context of WebAPI; there's no mention of it in the book.

share|improve this question
Don't it explain how the SSL works ? – user13934 Apr 12 '13 at 4:18

The data which send on the wire is not usually programmers work and it don't happen in the program layer , it happen in the transferring time . You could enable SSL on the web server to send and receive data encrypted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.