While this may seem like a generic security inquiry, it's directly related to the project I'm currently developing.
Here's the scenario: A web service (WCF Web Api) using an API Key for user validation, alongside a combination of jQuery and application on the front ends.
Although traffic can be secured with https, utilizing the same key per user poses a risk of potential impersonation if intercepted. This presents a dilemma in terms of maintaining security.
Implementing something similar to OAuth could mitigate this risk by generating a unique key per user and app. However, incorporating the API key in JavaScript for the jQuery aspect still raises concerns.
The issue mainly arises if someone views the page source while on the actual computer.
So, what should be the best course of action?
- Encrypt or use md5 on the key?
- Store the key in a session variable and retrieve it during ajax calls?
- Ignore the concern as it doesn't pose a significant threat.
I understand that this is a common challenge, which is why any guidance or advice would be greatly appreciated.
To clarify, this pertains to my custom API, not a widely recognized platform like Google. Therefore, implementing per session tokens is feasible; I am simply seeking the most secure way to manage client-side keys/tokens.
While perhaps overly cautious, this serves as a valuable learning experience for me.