Secure Ajax call On Rest Api

Question

This question has been asked to me in a interview. i search on web but can't find a thread that explains it in a way that makes sense to me.

Suppose is i had a web service which return a list of something and available In public Domain(Any body can use That) For security User need A key to Access that web service.

How can i use That web service securely in Ajax.

Problem is if i use Ajax to access that web service any body can able to see my private key,

I suggest for a encryption but i have to pass that key in decrypt(as i get )in form Than i suggest for a mediator file(at server side) on which i can call that web service but what if somebody directly access that mediator file (i know same origin policy )

i really want to know what are the possible solution to overcome to these problem and what is best practice to make a secure ajax call on rest

Answer 1

In fact, there is a dedicated security flow in OAuth2 for this particular use case called "Implicit Grant Flow".

You could have a look at these links for more details:

• http://www.bubblecode.net/en/2013/03/10/understanding-oauth2/#Implicit_Grant
• https://www.rfc-editor.org/rfc/rfc6749#section-4.2

If you don't use OAuth2, you can propose the user to authenticate and get back an access token. You could store it within the local storage of your browser but you need to be very careful with XSS. This question (and its answers) could provide you some hints regarding such issue: What are (if any) the security drawbacks of REST Basic Authentication with Javascript clients?.

Hope it helps you, Thierry