title: Securing REST API with hashed signature
body: <p>I've asked a question related to this one here:</p>
  
  <p><a href="https://stackoverflow.com/questions/13362629/securely-passing-userid-from-asp-net-to-javascript">Securely Passing UserID from ASP.Net to Javascript</a></p>
  
  <p>However now I have a more detailed/specific question. I have the service and I have the application that is going to consume the service my plan to secure it, is to generate a hash based on some values, a nonce, and a secret key. My only issue is that it seems that in order to verify the hash I will have to send all of the values plus the nonce, except the secret key. Is this a flaw in my design or is this how such things are done? I have googled around and haven't been able to find out if this is the right <em>and</em> secure way to do this.</p>
  
  <p>For example lets say I need to pass values 1,2, and 3 to my rest service, so I users phone number, the nonce, and, the secret key to generate a hash, now in order to generate the hash again I would need to pass all of the above except the key (which I can retrieve based on the users phone number). </p>
  
  <p>I am totally leaving my service up for attack, securing it properly, or somewhere in between?</p>
  
  <p>EDIT: made a spelling and grammar correction</p>
  
  <p>EDIT 2: Finally came to to a satisfactory solution by using MVC 4 with forms authentication, identical cookie names between two projects, and making use of a globally applied [Authorize] attribute</p>