Question

I want to make my ASP.Net site authentication seamless using Ajax call.
So I consider using client side authentication service of microsoft that should be used via HTTPS because it sends username and password in plain-text format.
And the problem is that I can’t use SSL in my site.

So I found a way to hash data before passing to web service that is described here
but the problem is there is a salt in DB that should passed to client for creating hashed password (that equals to DB saved password). and this is not safe.

Is there a better way for doing that?

Answer 1

I found a way.

Check this out: Secure AJAX Authentication without SSL