1

I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and am looking for a solution that is "good enough" to get the app usable without sending plaintext over the wire.

The app is built on .NET Web API and serves JSON to HTML/JS SPA clients. Eventually the clients will require their own API keys.

For now, I need to allow users to securely login and register using a username/password from these clients.

I began to implement Basic Authentication per Chapter 8 "Knowledge Factors" in the above mentioned book because of the simplicity, however it seems like this forces the clients to use a browser dialog to collect credentials, instead of collecting from a form.

Is there any way to get around this and use a form? If not, what would you suggest as an alternative security solution?

I was considering Forms Authentication but I'm not sure what the pros/cons are in the context of WebAPI; there's no mention of it in the book.

Improve this question
2

1 Answer 1

Reset to default
2

The data which is sent on the wire is not usually programmers' work and it doesn't happen in the program layer, it happens in the transferring time. You could enable SSL on the web server to send and receive encrypted data.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .