mvc api security

Assume I have super simple MVC API. Our customer will use html jquery to consume the API.
I want to add one token per customer. for example,


customer A token: asdfasdfasfasfasd
customer B token: 23423423423234dsf


1. If the customer's webpage put above token there to consume my API, it has security concern because I can see the token in view source.
2. What is the simple way to implment API with token? I only have 2 to 5 API so I do not need very complex one.

[System.Web.Http.HttpGet]
        public string Get(string firstname)
	{
return firstname;

}

Open in new window

LVL 1
ITsolutionWizardAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

KimputerIT ManagerCommented:
I'm not sure what you mean with "I can see the token in the view source", as you are the server and programmer, how is that an issue?
Anyway, if you want to make it more secure, the session HAS to start with a login form. After hashing, salting and checking against the user database, and the login is successful, issue a cookie and check this cookie for the rest of the session.
Obviously, you probably need 5 times the amount of code you didn't expect you'd need. But with any time of security, you'll have to do some more work.
ITsolutionWizardAuthor Commented:
Thank You. But let me tell you more in details.
All I need is to give API - end point to our customer. It is actually the company. I will give them end point and token so their company develop can consume our API using e.g. jquery ajax to consume/read the information through API.

No one will login in this situation.
Danilo AndradeIT Systems AnalystCommented:

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jose Gabriel Ortega CastroEE Solution Guide/Topic Advisor and CEO Faru Bonon ITCommented:
The solution is to use a "POST" call instead of a GET :)

[HttpPost]

        public string Get(string firstname)
	{
//validate request and token as header then return
return firstname;

}

Open in new window

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
.NET MVC

From novice to tech pro — start learning today.