Double authentication with Web app & Web API needed?

Question

I'm stuck on how to solve following problem. I'll start with describing what my app looks like in a general context.

[ ASP MVC (Angular App) ]

• Uses Owin cookie

[ WEB API 2 ]

• Uses Oauth Token Bearer

This scenario is happening: User visits app and authenticates with a login form which lies in ASP MVC app and generates a cookie.

Now I've decided to use AngularJs to add a couple features which made me use $resources and Web API 2. However, those features are only available if user is authorized.

To the problem: Now I must use a token for each request to the Web Api 2 to access different methods within controllers. This means I must login the user again but this time through AngularJs. Using /token route.

How would I do this? Should I take the cookie, check credentials in it and send it as a authentication request? Can I do something within the form authentication, in the same method, in the Asp MVC app?

Please help me, this gave me a lot of overhead. Walking from a simple app to this in 30min. Can't even get my head around all stuff in the authentication.

Regards!

Answer 1

My WebAPI supports both token and cookie auth.

During startup I register the authentication like this:

private void ConfigureAuth(IAppBuilder app)
{
    //Token 
    app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
    {
    });

    // Enable the application to use a cookie to store information for the signed in user
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
        LoginPath = new PathString("/Account/Login"), 
        Provider = new CookieAuthenticationProvider
        {
            OnApplyRedirect = ctx =>
            {
                // this is to ensure that a 401 response is sent if the
                // user is not authenticated, rather than redirecting to
                // a logon page.
            }
        },
        CookieDomain = ".example.com" //might not need to set this
    });
}