1

apologies for the n00b question, but I've found information sporadic on this one. I've been making an API using MVC Web API and have been using forms authentication as described in the SO selected answer here: ASP.Net MVC 4 WebAPI Authentication

As expected, the auth cookie is sent in the response header at login. However, when I then try a method decorated with [Authorize] after this, the request does indeed seem to include the auth cookie in the header, but I get a HTTP 401 every time.

The sources I've read indicate it should be almost trivially simple, so I'm actually not sure how to debug this one. How can I make sure the auth method actually works?

Community
  • 1
  • 1
jmillar
  • 355
  • 1
  • 3
  • 9
  • If you actually look at your cookies (with Firebug for example) do you see that the cookie was properly set? – Levi Botelho Nov 22 '12 at 18:52
  • I'm using Chrome to track the traffic requests and yes, the cookie set at the auth response is being resent for subsequent requests. It seems that the server side simply isn't acknowledging it. – jmillar Nov 23 '12 at 09:15

2 Answers2

4

I had the same problem. I eventually realised I had forgotten to enable Forms Authentication in the Web.Config file. Changing the mode from "None" to "Forms" fixed the problem:

<system.web>
    <authentication mode="Forms" />
</system.web>
James Allen
  • 819
  • 7
  • 12
0

So in the end, I ignored forms authentication and went to HTTP Basic Auth.

Couple of reasons for this - the implementation of it was easier for the clients (who connect via SSL over a secure network). It was also better documented for someone like myself who's new to Web API and MVC4.

A great tutorial on this can be found here:
http://www.piotrwalat.net/basic-http-authentication-in-asp-net-web-api-using-message-handlers/

jmillar
  • 355
  • 1
  • 3
  • 9