1

apologies for the n00b question, but I've found information sporadic on this one. I've been making an API using MVC Web API and have been using forms authentication as described in the SO selected answer here: ASP.Net MVC 4 WebAPI Authentication

As expected, the auth cookie is sent in the response header at login. However, when I then try a method decorated with [Authorize] after this, the request does indeed seem to include the auth cookie in the header, but I get a HTTP 401 every time.

The sources I've read indicate it should be almost trivially simple, so I'm actually not sure how to debug this one. How can I make sure the auth method actually works?

2
  • If you actually look at your cookies (with Firebug for example) do you see that the cookie was properly set? Commented Nov 22, 2012 at 18:52
  • I'm using Chrome to track the traffic requests and yes, the cookie set at the auth response is being resent for subsequent requests. It seems that the server side simply isn't acknowledging it. Commented Nov 23, 2012 at 9:15

2 Answers 2

4

I had the same problem. I eventually realised I had forgotten to enable Forms Authentication in the Web.Config file. Changing the mode from "None" to "Forms" fixed the problem:

<system.web>
    <authentication mode="Forms" />
</system.web>
Sign up to request clarification or add additional context in comments.

Comments

0

So in the end, I ignored forms authentication and went to HTTP Basic Auth.

Couple of reasons for this - the implementation of it was easier for the clients (who connect via SSL over a secure network). It was also better documented for someone like myself who's new to Web API and MVC4.

A great tutorial on this can be found here:
http://www.piotrwalat.net/basic-http-authentication-in-asp-net-web-api-using-message-handlers/

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.