title: Securing ASP.NET MVC controller action which returns JSON
body: <p>I have an MVC3 application, and my controller actions are secured using the [Authorize] attribute. So far, so good, forms auth works great. Now I want to add a JSON API to my application so some actions are accessible to non-browser clients.</p>
  
  <p>I'm having trouble figuring out the 'right' design.</p>
  
  <p>1) Each user has secret API key.</p>
  
  <p>2) User ID 5 calls <a href="http://myapp.com/foocontroller/baraction/5?param1=value1&amp;param2=value2&amp;secure_hash=someValue">http://myapp.com/foocontroller/baraction/5?param1=value1&amp;param2=value2&amp;secure_hash=someValue</a>. Here, secure_hash is simply the SHA1 hash of param1 and param2's values appended with the secret API key for the user</p>
  
  <p>2) /foocontroller/baraction will be decorated with [CustomAuthorize]. This will be an implementation of AuthorizeAttribute which will check if the request is coming in as JSON. If it is, it will check the hash and see if it matches. Otherwise, if the request is HTML, then I call into existing authorization.</p>
  
  <p>I am not at all sure if this will work. Is it normal to pass a secure hash in the query string or should I be passing it in as an HTTP header? Is it better to use HTTP basic auth instead of a hash made using the secret API key?</p>
  
  <p>Tips from anyone who has made a web API using ASP.NET MVC would be welcome!</p>