title: Browser-based REST api authentication
body: <p>I'm working on a REST webservice, and in particular authentication methods for browser-based requests. (using JsonP  or Cross-domain XHR requests/XDomainRequest).</p>
  
  <p>I've done some research in OAuth, and also Amazon's AWS. The big drawbacks of both is that I need to do either of the following:</p>
  
  <ul>
  <li>Store secret tokens in the browser</li>
  <li>Let a server-side script handle the signing. Basically I'd first to a request to a server of mine to get a specific pre-signed javascript request, which I'll use to connect to the real REST server.</li>
  </ul>
  
  <p>What are some other options or suggestions? </p>