How to secure WebAPI application / HTML+JS clients?

Question

I've spent the past week on SO and in books reading about authentication and started to roll out Basic Authentication for my WebAPI so that HTML clients can let users login/register/logout, but Basic Auth doesn't facilitate logging out so I'm back at square one.

Details:

1. I don't need to let users log in with other services. I don't need facebook or google logins. Just a username/password.

2. I need users to be able to log in / log out / register from the client application (not the browser).

3. I don't mind sending credentials over the wire since I'll be using SSL.

4. Currently there's only one client but there will be others accessing the API, so I'll need to implement something akin to api keys in the future. Maybe this is a separate issue.

5. I have a RESTish WebAPI that accepts/returns JSON to html/js clients in other domains.

6. This is for prototyping so I don't need the best possible solution, just something that's good enough for pre-release and has a low time-to-implement.

Where should I start? What would you do, and why? Is Forms Auth an option?

Answer 1

In the question you have

I don't mind sending credentials over the wire since I'll be using SSL.

In the comment to the answer you have said

I just don't want users sending plaintext passwords over the wire.

Not sure what exactly you are looking for but Forms Authentication is definitely an option. you can use basic authentication as well but it has a few drawbacks like you mentioned: no logout, etc. You must use HTTPS with basic authentication.

If browser popup is the main concern, you can get around that by preemptively sending the credentials in the very first request. Normally, the first request goes without the Authorization request header. Service responds with a 401 and sends back WWW-Authenticate response header indicating basic scheme. This is when browser pops up the dialog and asks for user id and password, packages it in the basic scheme and sends the Authorization header.