title: secure rest API for running user "apps" in an iframe
body: <p>I want to let users create "apps" (like Facebook apps) for my website, and I'm trying to figure out the best way to make it secure.</p>
  
  <ol>
  <li>I have a REST api</li>
  <li>i want to run the user apps in an iframe on my own site (not a safe markup language like FBML)</li>
  </ol>
  
  <p>I was first looking at oAuth but this seems overkill for my solution.  The "apps" don't need to be run on external sites or in desktop apps or anything.  The user would stay on my site at all times but see the user submitted "app" through the iframe.</p>
  
  <p>So when I call the app the first time through the iframe, I can pass it some variables so it knows which logged in user is using it on my site.  It can then use this user session in it's own API calls to customize the display.</p>
  
  <p>If the call is passed in the clear, I don't want someone to be able to intercept the session and impersonate the user.</p>
  
  <p>Does anyone know a good way to do this or good write up on it?  Thanks!</p>