title: RESTFul Authentication with WebAPI
body: <p>I have a web service built with WebAPI that accepts JSON requests and responds accordingly.  The core architecture is built but there isn't any authentication/authorization.  </p>
  
  <p>After a lot of googling and poking around sample projects, I'm not sure where to start.  I've found a ton of material from 2008 and 2009 but not a whole lot of recent guides/workflows for WebAPI / single page apps.  I think the workflow should be as follows: </p>
  
  <ol>
  <li><p>Check to see if the user is logged in: How can this be done with javascript?  Do I send a cookie to my webAPI?  If so, do I send that cookie as a parameter in the body of the request?  </p></li>
  <li><p>Let the user log in / register: How is this data encrypted/decrypted?  Surely I can't be sending passwords over the wire... is this where SSL comes in?  </p></li>
  <li><p>Provide them with access to what they have rights to access: I think I got this - I can just authorize in the controllers on a per-request basis.  </p></li>
  </ol>
  
  <p>Any info would be awesome.  </p>