Agreed. Getting authentication right when hosting your API on a different subdomain is difficult. You can write an HTTP handler to implement CORS but it's less

Agreed. Getting authentication right when hosting your API on a different subdomain is difficult. You can write an HTTP handler to implement CORS but it's less than optimal if you also want to support Ajax within your app, in addition to normal API usage. As an alternative, you can implement your API in a different project and host it on a virtual path (e.g., /api). This solves the auth problem, but it poses difficulties under IIS. In particular, your Web.config inherits from the parent Web.config, so sections can be clobbered. Ultimately, it's easiest to just host your app and your API in the same project. You can implement forms auth (or roll your own cookie auth) so your Ajax requests Just Work (TM) and then implement separate auth (like Basic Auth or OAuth) on just the API controllers to support real API usage.