WCF Service Security when the clients can be Javascript Clients
===

How to secure a WCF service which can be consumed by Javascript clients? Any specific security model for this?

What I understand is WCF Support encryption of data over wire using Transport and Message Security. But the WCF is still not fuly secure because anyone can consume the service (Authentication is missing). Only the data moves "to and fro" is encrypted over the channel. Which is not sufficient. So, we introduced Mutual Authentication and choosed Certificate as cridentials.What the clients needs to do is: Along with all SOAP Request, he should send a valid certificate (client cridential contains public and PRIVATE KEY as well and issued by WCF Administrator) which is issued by a CA whom my servers trust.

We are using basicHttpBinding because our clients can be Javascript/Ipad/.Net/DBL clients. We are able to consume such services using .Net/SOAPUI/JAVA clients. So we were good with this approach.

But today during an Analysis we found that JavaScript clients can't consume our service because it doesnt support mutual authentication (correct me if I am wrong). Even if it support mutual authentication and post a valid Certificate to server, we cant afford all clients (web browsers) to provide the client certificate because it contains a Public and a PRIVATE keys as well (please note PRIVATE KEY AS WELL!!) and which my server trusts blindly.

Now I am little confused. Can someone suggest some security model which is supported by JavaScript without any  security compromise. Something like RESTful WCF. 

I understand that JavaScript doesnt support Message Security and it only supports Transport Security. I dont care how data gets encrypted over the wire. I care is how client gets authenticated by my WCF Service.


Many Thanks