Combining tokens and cookies auth for MVC 5 / Web API app

Question

I have a web app that contains:

• Normal MVC controllers - must use cookie auth only
• Web API Controllers, that are used internally by the app (jquery calls etc) - should use cookie auth also
• Web API Controllers that are used externally (e.g. by a phone app) - must use token auth

Now, I've got the (Identity) auth set up so that it has:

app.UseCookieAuthentication(...) to setup the cookie auth for the web app; and app.UseOAuthBearerTokens and app.UseOAuthBearerAuthentication to setup the token based side of things.

Is it possible to make sure that the MVC side of things doesn't support the tokens, and the web API side of things supports the tokens? Since some of the web API stuff is internal and some external, I think I'm happy if the API endpoints support either cookies or tokens.

Thanks.

Answer 1

Unless you have two different endpoints that can be differentiated at the Startup.cs level, you would need to create a custom ActionFilter to handle this scenario.