title: What is the best way to secure a webservice?
body: <p>As the title allready explains I want to secure my webservice.
  I've read that you can do this using an soap authentication header, but then the username en password are passed as plain text.</p>
  
  <p>I was wondering what I should do to secure my webservice?
  Examples would be great.</p>
  
  <p>I have an example of a company we work with that has 2 webservices.
  One to do the security and one to get the needed data but I don't have their side of the code the system looks great though:</p>
  
  <pre><code>bool loginSuccessFull = false;
  
  /// knooppunt
  string loginID = ConfigurationManager.AppSettings["WebServiceLogin"];
  string password = ConfigurationManager.AppSettings["WebServicePass"];
  
  
  //A. The m_SecurityService object is created and initialised
  Security securityService = new Security();
  securityService.CookieContainer = new System.Net.CookieContainer();
  
  
  string challenge = securityService.InitializeLogin(loginID);
  string pwd = password;
  string response = pwd + challenge;
  
  
  System.Security.Cryptography.SHA1CryptoServiceProvider SHA1 = new System.Security.Cryptography.SHA1CryptoServiceProvider();
  SHA1.Initialize();
  byte[] hash = SHA1.ComputeHash(System.Text.Encoding.Default.GetBytes(response));
  
  System.Text.StringBuilder builder = new System.Text.StringBuilder();
  foreach (byte b in hash)
      builder.Append(b.ToString("x2"));
  
  //2. A login is done with the m_SecurityService object
  if (securityService.Login(builder.ToString()))
  {
      string ssoToken = Request.QueryString["SSOTOKEN"];
      string ssoID = Request.QueryString["SSOID"];
      if (!String.IsNullOrEmpty(ssoToken) &amp;&amp; !String.IsNullOrEmpty(ssoID))
      {
          // Check with webserice if the token is valid.
          Knooppunt.SSO.GenericSSO sso = new Knooppunt.SSO.GenericSSO();
          sso.CookieContainer = securityService.CookieContainer;
          try
          {
              if (sso.validateSSOToken(Convert.ToInt32(ssoID), ssoToken))
              {
                  loginSuccessFull = true;
                  FormsAuthentication.RedirectFromLoginPage("default user", false);
              }
          }
          catch
          { }
      }
  }
  </code></pre>