Question

I have a WCF application where I make JavaScript calls to. I want to secure the web services so you have to be logged in to use it. This is easy if I have a server-side application making the requests to the WCF. If I am using a pure JavaScript / jQuery client-side app, I can authenticate fine by passing the credentials as JSON parameter, but how do I keep that client-side app logged in from that point on? Do I store a cookie? I do not want to store the credentials in the cookie of course because that is not secure. So how can I achieve this without introducing another server-side application to the mix? How do web apps achieve this?

Answer 1

OAuth is kind of the go to solution for JS API’s. Netflix, Yelp, Facebook etc. use this.

Here is an article on OAuth in WCF

And here is a pretty well known library for doing auth in .NET: DotNetOpenAuth