WCF Security: What is best for intranet with mostly java clients?

Question

The data is not sensitive, I am really only considering security so that I can keep track of who is calling our system.

I thought of just having each 'client' send an 'api-key' in the request and cross-check against a list of valid keys.

I could then log the request and monitor activity by client.

Note: performance is very critical so I can't afford alot of overhead.

any ideas?

Answer 1

HTTP's Basic auth is fairly lightweight and it can be used for both RESTful service and SOAP. See Basic Authentication with WCF REST service to something other than windows accounts? for details.