We are about to implement a SPA app in JavaScritp/AngularJS that will use WebAPI to handle data transfer. This will be implemented using DNN (as a DNN module). Now, we also want to implement authentication in our Business Layer to validate who is supposed to access what. And to do this, we have to transfer the DNN User ID in a secure way. For obvious reasons, we can't just have a "int userID" as inparameter in the WebAPI as it wouldn't take much for someone to send in another UserID than they should. 

We consider using the DNN AuthCookie generated by DNN on login, but the problem is that as far as I know, that is only available on the same domain as DNN is running. This would require us to put the WebAPI as a childapplication to the DNN site, which will cause some problems as the root web.config of DNN will most likely interfere with the childapplication. 

I know that DNN has a Service Framework supposed to help out with WebAPIs that seem to be working fine. However, I am not sure if that would still work for a more complex WebAPI that in turn might call some external services like a WCF service to access the Business Layer or if it just works with a simple stand alone WebAPI controller? What would be other good solutions to solve this when using a client side application written in JavaScript? Is OAuth something worth looking into for this or is it overkill? Is it possible to set the DNN Auth cookie to a domainname that will work with subdomains as well, preferably without having to modify the code of DNN Core? 

Any help and comments are appreciated.