title: Securing routes in WebApi
body: <p>I am using ASP.NET WebApi 2 for a REST interface to an ASP.NET MVC 5 application.</p>
  
  <p>I am using Forms Auth for authentication.</p>
  
  <p>My question is what is the best approach to secure WebApi routes that take parameters in the context of different users.</p>
  
  <p>Example: A customer can access this example route to view an order.</p>
  
  <pre><code>http://host/api/customer/order/{orderId}
  </code></pre>
  
  <p>But what about when another customer that does not have access to that order comes along and tries to hit the same endpoint?</p>
  
  <p>Also, I want the services to be able to be used by an admin that would have access to any order id.</p>