Tell me more ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.
up vote 1 down vote favorite
1

apologies for the n00b question, but I've found information sporadic on this one. I've been making an API using MVC Web API and have been using forms authentication as described in the SO selected answer here: ASP.Net MVC 4 WebAPI Authentication

As expected, the auth cookie is sent in the response header at login. However, when I then try a method decorated with [Authorize] after this, the request does indeed seem to include the auth cookie in the header, but I get a HTTP 401 every time.

The sources I've read indicate it should be almost trivially simple, so I'm actually not sure how to debug this one. How can I make sure the auth method actually works?

share|improve this question
If you actually look at your cookies (with Firebug for example) do you see that the cookie was properly set? – Levi Botelho Nov 22 '12 at 18:52
I'm using Chrome to track the traffic requests and yes, the cookie set at the auth response is being resent for subsequent requests. It seems that the server side simply isn't acknowledging it. – jmillar Nov 23 '12 at 9:15

2 Answers

up vote 3 down vote

I had the same problem. I eventually realised I had forgotten to enable Forms Authentication in the Web.Config file. Changing the mode from "None" to "Forms" fixed the problem:

<system.web>
    <authentication mode="Forms" />
</system.web>
share|improve this answer
up vote 0 down vote

So in the end, I ignored forms authentication and went to HTTP Basic Auth.

Couple of reasons for this - the implementation of it was easier for the clients (who connect via SSL over a secure network). It was also better documented for someone like myself who's new to Web API and MVC4.

A great tutorial on this can be found here:
http://www.piotrwalat.net/basic-http-authentication-in-asp-net-web-api-using-message-handlers/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.