title: REST service through SSL and HTTP Basic Authentication
body: <p>In <a href="https://stackoverflow.com/questions/5511589/securing-an-api-ssl-http-basic-authentication-vs-signiture">Securing an API: SSL &amp; HTTP Basic Authentication vs Signature</a> HTTP Basic Authentication is cited as an adequate way to secure REST web service calls if the REST calls are made through SSL.</p>
  
  <p>But it seems this method will still not work for an unsecured client page that uses Ajax to make calls to the REST service that is protected behind SSL &amp; Basic Auth. </p>
  
  <p>I am trying to design an application that performs password reset using the usual way:</p>
  
  <ol>
  <li>user enters username and requests "reset password" email </li>
  <li>user receives email with a password reset link that includes a verifiable token</li>
  <li>user clicks on the link and (after the token is verified) types in their updated password </li>
  </ol>
  
  <p>By definition these pages <strong>do not</strong> require login. Can this UI be implemented using Ajax that calls REST services to do things like validate token, send email, etc.? Even if those REST services are protected behind SSL &amp; Basic Auth, the information that you need to call the service (i.e. the <em>application's</em> "username" and password) will be at best in cookies which would be accessible through the browser. </p>
  
  <p>I know I am missing something. I just don't know what :-) </p>