Hi,

I'd like to implement a REST api to an existing ASP.NET MVC website. I've managed to set up WCF Data services so that I can browse my data, but now the question is how to handle authentication.

Right now the data service is secured via the site's built in forms authentication, and that's ok when accessing the service from AJAX forms. However, It's not ideal for a RESTful api.

What I would like as an alternative to forms authentication is for the users to simply embed the user name and password into the url to the web service or as request parameters.

For example, if my web service is usually accessible as

http://localhost:1234/api.svc

I'd like to be able to access it using the url

http://localhost:1234/api.svc/{login}/{password}

So, my questions are as follows:

• Is this a sane approach?

• If yes, how can I implement this? It seems trivial redirecting GET requests so that the login and password are attached as GET parameters. I also know how to inspect the http context and use those parameters to filter the results. But I am not sure if / how the same approach could be applied to POST, PUT and DELETE requests.

Thanks,

Adrian