Does anyone have some good suggestions when it comes to authenticating clients using JQuery or JavaScript? I realize that any JavaScript client is going to send clear text, but has anyone come up with a good solution to mask the authentication?
One thought I had, was to limit the requests per domain. I had written this post a while back asking if there was a way to get the calling domain to a wcf service. So, I could issue an encrypted token to the user. So, when they make a call they pass that token in and in that token is their calling domain. If the actual calling domain and the token’s version do not match up, then they are not authenticated.
I really like this idea