title: calling my web api from jquery securely
body: <p>I have a simple question that may point out to a complicated answer :(</p>
  
  <p>I have a web api which works fine. But now I want to set up Authentication/Authorization.
  I need it to work on all platforms, but mainly from jQuery. Naturally I don't want to send my username and password along the pipeline in plain text like this:</p>
  
  <pre><code>function GetAllCategories() {
      var credentials = $.base64.encode('r3plica:mypassword');
      var authType = "Basic " + credentials;
  
      $.ajax({
          url: "http://localhost:18904/api/Categories",
          type: "GET",
          beforeSend: function (xhr) {
              xhr.setRequestHeader("Authorization", authType);
          },
          success: function (data) {
              alert('Success!');
          },
          error: function () {
              alert('error');
          }
      });
  }
  </code></pre>
  
  <p>so I have been looking at other alternatives. 
  Is the only alternative to use 3 legged OAuth? I was hoping to just pass a query string key/value to my api and let that handle everything but I just can't find a step by step process for doing that.
  Everything seems so complicated.</p>
  
  <p>So, does anyone know of anything I can do? I have read loads and tried to implement loads of stuff.</p>
  
  <p>I managed to get this working: <a href="http://codebetter.com/johnvpetersen/2012/04/04/moving-from-action-filters-to-message-handlers/" rel="nofollow">http://codebetter.com/johnvpetersen/2012/04/04/moving-from-action-filters-to-message-handlers/</a>
  From what I can tell though, you need to encrypt your string (username) prior to sending to the api using your public key and then the api will decrypt using a private key and authorize you. </p>
  
  <p>so my 2 questions are simple :)</p>
  
  <ol>
  <li>Can you use the above link and call from jQuery easily (i.e. not using 3rd party libraries)</li>
  <li>If not, what is the best way to go about securing my API so that it can be called directly from an jQuery.ajax call?</li>
  </ol>
  
  <p><strong>Just to clarify, I am using SSL for the API</strong></p>
  
  <p>Cheers in advance,</p>
  
  <p>/r3plica</p>