title: How to secure a controller on WebAPI for use by only the local machine
body: <p>I have an ASP.NET MVC website that makes use of WebAPI, SignalR.</p>
  
  <p>I wish for my server (the same server that hosts the website) to make HTTP requests to a WebAPI controller - I wish to do this so that I can hook into my website's SignalR functionality.</p>
  
  <p>I want to make it so that the websites users can't access the methods on the WebAPI controller, but the server can.</p>
  
  <p>I have looked at the options for securing WebAPI requests generally and it seems like I have the following options available to me:</p>
  
  <ul>
  <li>Send a username and password over each request AKA Basic Authentication</li>
  <li>Generate a "Client Certificate" and send that with each request</li>
  </ul>
  
  <p>These are the only two methods that sound like they would work, but I wonder if it's overkill to use these methods if the requests are going to originate from localhost (the same server).</p>
  
  <p>Is it overkill, is there an easier way to restrict HTTP requests from the local machine to a WebAPI controller?</p>