What is the safest way to implement Web Services / API?

Question

I have a web site with users and their data accordingly.

What is the safest way to implement web services / API such that users' login credentials and in turn data are secure? oAuth isn't really an option, because usage will not necessarily be in other web apps.

My concern is that having the username and password as an input is dangerous to be transmitted plainly, and a token could also be stolen and reused maliciously.

Do I need to come up with my own method of encrypting and decrypting data, or is there a common practice(s) already in use?

The whole point is that it's as open as possible for anyone in the world to use, but safe by definition nonetheless. Documentation will be available to everyone to use.

Answer 1

What about using an SSL connection?

Answer 2

Don't write your own encryption.

What is wrong with a bit of SSL? With "regular" WSDL/SOAP clients (asmx), it isn't uncommon yo use a SOAP header for this (over SSL).

With WCF, this is formalised into TransportWithMessageCredential (just search). Of course, you could use certificates, federation, kerberos, etc...

In addition to transport security (SSL), WCF also supports message-based security - with the added feature that you can encrypt just the security headers. Personally, I like to keep it simple, with TransportWithMessageCredential (i.e. SSL).

Answer 3

There's always the WS-Security standard:

WS-Security (Wikipedia)

.NET has its implementations in .NET 1.1 and .NET 2.0 via the Microsoft Web Service Enhancements:

WSE 2.0 (.NET 1.1)
WSE 3.0 (.NET 2.0)

It provides various methods on encrypting the SOAP Envelope before it is sent over the wire, safely transmitting the data inside.

Answer 4

Why don't you use the standard WS-Security for that?

Edit: Just want to add to Justin's answer, that it is also implemented in WCF.

Answer 5

Any authentication method that's shared with a 3rd party is open to exploitation, you have to draw a line somewhere. Using HTTP/S and WS-* services to secure the connection is probably your best approach. If the service is only going to be accessed by known systems with fixed IP addresses then use firewalling to further secure your box from external interference.