RESTful WCF Data Service Authentication - asp.net-mvc

Question

I'd like to implement a REST api to an existing ASP.NET MVC website. I've managed to set up WCF Data services so that I can browse my data, but now the question is how to handle authentication.
Right now the data service is secured via the site's built in forms authentication, and that's ok when accessing the service from AJAX forms. However, It's not ideal for a RESTful api.
What I would like as an alternative to forms authentication is for the users to simply embed the user name and password into the url to the web service or as request parameters.
For example, if my web service is usually accessible as
http://localhost:1234/api.svc
I'd like to be able to access it using the url
http://localhost:1234/api.svc/{login}/{password}
So, my questions are as follows:
Is this a sane approach?
If yes, how can I implement this?
It seems trivial redirecting GET requests so that the login and password are attached as GET parameters. I also know how to inspect the http context and use those parameters to filter the results. But I am not sure if / how the same approach could be applied to POST, PUT and DELETE requests. Can I use GET parameters in POST, PUT and DELETE requests?
Edit: The question for me how to embed login and password into the web service's URL so that I can perform POST, PUT and DELETE requests against the web service. I do know how to implement authentication once the web service is running and the login / password are contained somewhere in the HTTPContext. Also, I am not looking for ways to implement forms or basic authentication. I know how to do it, but it is not what I am looking for.

Answer 1

In the end I used a threefold approach, either of these authentication methods work fine on my data service:
Basic authentication with the API key as password
Authentication via an API key embedded as request header
URL-based authentication with the API key as path to the API. I implemented this with a proxy ASP.NET MVC controller.

Answer 2

I've not had to use restful via authentication but I do have to ensure that groups of users have the rights to access the rest service. This I do via an MD5 token that gets passed to the web service (this is a normal JSON service, not a WCF wrapper). Basically, I "know" which websites are allowed access to my service, so I give them their own API key (which for simplicity is an MD5 of the domain name. This gets checked incoming by a filter against the urlreferrer and if the MD5 of it matches, then it's a go.
I know this isn't the authentication answer but it's a mid-trust approach that works if you need only a very course level of "authentication".
I'd be interested to see how others do this, though, for other projects that I may need a less course grained approach to authentication.

Answer 3

See if below answers helps you:
your first question:
Is this a sane approach?
If your service is running over https, I dont see any probelm to use this method.
If yes, how can I implement this?
You can use GET parameters in your other methods eg. Here stream is passed in body.
[OperationContract]
[WebInvoke(Method="POST", UriTemplate = "UploadFile/{fileName}/{userToken}")]
string UploadFile(string fileName,string userToken,Stream fileContents);

Answer 4

OData - WCF Data Services Best Practices from TechEd - Meta-Me - Site Home - MSDN Blogs
<system.web.extensions>
<scripting>
<webServices>
<authenticationService enabled="true" />
</webServices>
</scripting>
</system.web.extensions>
How about this?