The above link shows exactly how I want to go about authenticating against an ASP .NET Web API. It looks very easy but how safe is it in practice?
It involves creating your own encrypted token by stringing together the user's user ID and the IP address of the client being authenticated. Then authenticating that string variable using some kind of encrypting technology.
Then upon each subsequent request that is sent to the API by the same user, the API will check if the token is valid (it comes from the same client that authenticated, it has not timed out, etc.).
The token will be checked by decrypting the token and checking that the client ID that comes out of the decryption is the same as that of the requester's IP.
