title: How to Secure WebAPI with Single-Page
body: <p>I'm building an application with an MVC4 single-page front end and a WebAPI on another machine that returns json query data directly to the browser. The authentication happens on the MVC side where a user object is built that defines a set of "canDoX" permissions for the current user.</p>
  
  <p>The problem is how do I secure access to the WebAPI actions based on those permissions without re-authenticating and authorizing the user all over again when it receives the request from the page .js.</p>
  
  <p>As it stands, the user would have to know about the api, but if they did they could hack the url and query whatever data they want by <code>'/api/myController/myRestrictedAction/123'</code></p>
  
  <p>Any ideas? Should I scrap the single-page idea and just call the webAPI from the MVC controller?</p>