.net - Calling a secured WebService from jQuery safely -

i have webservice has several calls available members of site. want build pure html/jquery mobile app can call service make requests , download information.

my initial plan put users' username , password in auth header i'm worried exposing them traffic sniffers. can create session key after initial authentication call in token may vulnerable session stealing.

my current plan is:

• implement login call, return token expire after designated time
• the js calls in token (thereby reducing number of times password sent).
• the user makes calls
• the token compared against user's ip address.
• the user logs out, ends session , removes key reduce risk

another thought encrypt password send it. possible/sensible public/private key encryption in js based on .net rsacryptoserviceprovider implementation?

what best approach handle authentication, ideally without purchasing ssl certificate (the data not particularly sensitive). ?

apart obvious reasons why ssl highly recommended, , should use if it's possible, can consider rising security hashing login , password.

hashes work in way difficult break - hashes of similar strings different, if change 1 char. see that:

login: "jacek", sha1: "9749d1492af3d43f9c09e04c5c43f27bb909af51" login: "jacek", sha1: "46c676716f0e9aa86545c034d0e22a114d7cd488" 

this shows need exact password (or it's hash collisions, difficult compute) 'break' hash, , 'simmilar' 1 useless.

your implementation may go that: when create user (f.e. registration moment), compute hash of login , password. after that, in db have:

login  | hashedlogin                              | hashedpassword  --------------------------------------------------------------------------------------------- jacek  | 9749d1492af3d43f9c09e04c5c43f27bb909af51 | e4e088f4eaa96db85e11ba491a189f96f2e11793 

(you may keep unhashed login debugging / maintanence purposes only.)

after that, before conect web service in app, same, in jquery:

var _hashedlogin = sha1_hash($("#login").text()); var _hashedpassword = sha1_hash($("#password").text()); 

there lots of third-party sha1 libs, use of them ;)

then, when send info webservice, send hashed values only. if sniffs ajax call, like:

"userinfo": {     "login" : "9749d1492af3d43f9c09e04c5c43f27bb909af51",     "pass" : "e4e088f4eaa96db85e11ba491a189f96f2e11793" } 

this useless thief, can compare values precomputed hash in database. can run

select id users hashedlogin = 'login_from_your_ajax_call' , hashedpassword = 'pass_from_your_ajax_call'; 

if result of query, secured verification completed , have id of user. if there no results, login or password invalid.

sha1 quite secure home , semi-pro reasons, compute hash collide password, may need 2^61 comparisons. take literally years home computer break that. solution still vulnerable man-in-the-middle attacks, leap of security sending plaintext authentication data.

also, remember once user authenticated, unless use ssl, all other (client <-> web service) connection still insecure , easy sniff.