Web api authentication techniques

Question

We have a asp.net MVC web service framework for serving out xml/json for peoples Get requests but are struggling to figure out the best way (fast, easy, trivial for users coding with javascript or OO languages) to authenticate users. It's not that our data is sensitive or anything, we just want users to register so we can have their email address to notify them of changes and track usage.

In our previous attempt we had the username in the URI and would just make sure that username existed and increment db tables with usage. This was super basic but we'd notice people using demo as a username etc so we need it to be a little more sophisticated.

What authentication techniques are available? What do the major players use/do.

Answer 1

I asked that question on StackOverflow and you can read it here. Also see my answer to my own question. Which is about authentication precisely without having to pass the password for each request, and without SSL or Encryption. Just simple hashing.

• You might be interested in this.
• Be sure to check Flickr API.
• Don't forget tor ead How to Design a Good API and Why Does It Matter
• I also get very inspired by the StackOverflow API.

Answer 2

This video is an interesting way of using an API key with your WCF/REST service. code.

Answer 3

I take it your using visual studio. If your using vs 2010 with 4.0 framework, you could check out the "WCF REST Service With API Key Verification" template in vs 2010.

Answer 4

I always use HTTP authentication for web services. The authentication itself would be handled by your web server, likely IIS in your case. You would then configure IIS to authenticate against your database, an LDAP store, or similar.

You would then access the username via the property User.Identity.Name

EDIT: JQuery authentication example:

/* I found that providing the username and password both in the
   the arguments and in the url parameter seems to have better compatibility,
   if it works well for you, it is highly advisable to remove the 
   user/pass from the url */

function doLogin (){
  $.ajax({
    username: $('#username').val(),
    password: $('#password').val(),
    url: 'https://'+$('#username').val()+':'+$('#password').val()+'@api.example.com',
    dataType: 'jsonp',
    context: $('#result'),
    success: function(d) { $(this).html(d); $(location).attr('href','https://api.example.com/success'); }
    });
    return false;
}