I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and am looking for a solution that is "good enough" to get the app usable without sending plaintext over the wire.
The app is built on .NET Web API and serves JSON to HTML/JS SPA clients. Eventually the clients will require their own API keys.
For now, I need to allow users to securely login and register using a username/password from these clients.
I began to implement Basic Authentication per Chapter 8 "Knowledge Factors" in the above mentioned book because of the simplicity, however it seems like this forces the clients to use a browser dialog to collect credentials, instead of collecting from a form.
Is there any way to get around this and use a form? If not, what would you suggest as an alternative security solution?
I was considering Forms Authentication but I'm not sure what the pros/cons are in the context of WebAPI; there's no mention of it in the book.