title: WCF Rest Service with basic token authentication
body: <p>We've built a WCF Rest service with various functions allowing us to access data from our database but we'd like to restrict access to these functions for obvious security reason but it doesn't have to be too complicated.</p>
  
  <p>In short, this is what I had in mind:</p>
  
  <ol>
  <li><p>The first steps to access our service is to call a logon function of some sort where a username and password are passed.</p></li>
  <li><p>When authenticated against our database (or other), it would generate a token of some sort i.e. GUID will do and store this in a session or a cookie on the server.</p></li>
  <li><p>Whenever another function is called, it would require to pass this token which would then be validated against the tokens held in sessions or cookie on the server rather than having to validate it again our database. </p></li>
  </ol>
  
  <p>If it passes, the rest of the function would execute otherwise, it would throw back an error and the logon function would require to be called again.</p>
  
  <ol start="4">
  <li>The session or cookie would expires every x minutes.</li>
  </ol>
  
  <p>Questions:</p>
  
  <ol>
  <li><p>Now is the above too simple?</p></li>
  <li><p>Can you use session with wcf rest services as we may not an asp.net website or other? This would just run in IIS under http or https.</p></li>
  <li><p>Am I better off using cookies of some sort on the server instead of session, but can these expire?</p></li>
  <li><p>When passing the token, can I just pass it as part of my json object or should I pass this as a custom header of some sort?</p></li>
  </ol>
  
  <p>Sorry if my suggestions or questions sound ridiculous or rather simplistic, but I know absolutely nothing about web authentication but everything I'm reading seems complicated for what I want to achieve. As I said, it doesn't have to be over complicated. I just want to restrict users from using this web service if they are not authorized or granted permission.</p>
  
  <p>Can you redirect me to a sample? Any help or suggestion would be greatly appreciated.</p>
  
  <p>I'd like to implement this before releasing to our clients.</p>
  
  <p>Thanks.</p>
  
  <p>Thierry</p>
  
  <p><strong>Update:</strong></p>
  
  <p>This post actual has a good visual representation of what I'm trying to achieve:</p>
  
  <p><a href="https://stackoverflow.com/questions/2576509/wcf-rest-based-services-authentication-schemes">WCF REST based services authentication schemes</a></p>