title: Web services API Keys and Ajax - Securing the Key
body: <p>This is probably a generic security question, but I thought I'd ask in the realm of what I'm developing.</p>
  
  <p>The scenario is: A web service (WCF Web Api) that uses an API Key to validate and tell me who the user is, and a mix of jQuery and application on the front ends.</p>
  
  <p>On the one hand, the traffic can be https so it cannot be inspected, but if I use the same key per user (say a guid), and I am using it in both then there's the chance it could be taken and someone could impersonate the user.</p>
  
  <p>If I implement something akin to OAuth, then a user and a per-app key is generated, and that could work - but still for the jQuery side I would need the app API key in the javascript.</p>
  
  <p>This would only be a problem if someone was on the actual computer and did a view-source.</p>
  
  <p>What should I do?</p>
  
  <ol>
  <li>md5 or encrypt the key somehow?</li>
  <li>Put the key in a session variable, then when using ajax retrieve it?</li>
  <li>Get over it, it's not that big a deal/problem.</li>
  </ol>
  
  <p>I'm sure it's probably a common problem - so any pointers would be welcome.</p>
  
  <p><strong>To make this clearer</strong> - this is my API I have written that I am querying against, not a google, etc.  So I can do per session tokens, etc, I'm just trying to work out the best way to secure the client side tokens/keys that I would use.</p>
  
  <p>I'm being a bit overly cautious here, but just using this to learn.</p>