title: MVC 4 Web Api Security
body: <p>I am very new in web api security. I have used form authentication technique. when user logs in, a token is created and stored as a cookie in user's web browser. On each request the token is varified and if user is authenticated and authorized user is given access to the service.</p>
  
  <p>but I think this approach does nothing in web api security. cookies can easily be copied and pasted in other browser and anyone can get the service.</p>
  
  <p>I am thinking to use App key and secret along with form authentication. I am not suggested to use third party service like Oauth for authentication. I am not Sure about the Implementation of app key and secret that how it exactly works.</p>
  
  <p>Please provide better way to secure my web api wihtout using third party services and to prevent cookie hijacking etc.  What actions are performed to build a strengthly secure web api.</p>