Two-factor authentication in restful web api

Question

I'm building a new asp.net web api application using straight html 5 and a web api restful service. I'm already using forms authentication and the [Authorize] attribute to secure my web api calls. I'm trying to stay true as much as I can to the restful principles.

I'm mimicking what an existing app does that uses two-factor authentication and uses asp.net web forms. The two-factor authentication is not used for logging in, but for an additional task of remoting into another machine through the site and a plugin.

The existing web application uses session state to store a pin that is generated and emailed to the user. Then when the user enters in the pin it is checked against the pin in session state.

So it seems like my options are...

1. Encrypt the pin generated on the server and send it back to the client in javascript. This option seems like a security risk. This would be more of a restful option.
2. A co-worker suggested using something like what Amazon S3 does using a public/private key pair.
3. Use session state despite using web api.

So what out of these options is the best option? Are there other possibilities?

Answer 1

I'm not 100% sure I understand your architecture, but it seems very relevant that your security should at no point rely on the client.

Assume the user has a javascript debugger in their browser (which most people actually do without realizing), and a custom build of your plugin.

So the secondary PIN challenge should be embedded on the server side into the "remoting" protocol. If it is something based on RDP or VNC, it should be possible to change the connection password of the given user on the fly to the one-time generated PIN.