0

I've got 2 different applications that are both using MVC with a web api that gets called with AngularJS.

Application #1 is accessed to check and see if they have access to application #2. If they do I'm trying to call the Web API of application #2 from #1, which works fine.

The problem is how do I authenticate with OWIN? I've got it so It signs in and everything on the Web API of Application #2, but when the angular call comes back, and try to navigate from #1 - > #2, I am no longer authenticated.

The controller on API #2.

//Setup Identity above
var ctx = Request.GetOwinContext();
    var authManager = ctx.Authentication;
    authManager.SignIn(identity);

OWIN Setup on MVC/API #2

app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = "ApplicationCookie",
            LoginPath = new PathString("/Account/Login"),
            SlidingExpiration = true,
            ExpireTimeSpan = new TimeSpan(1, 0, 0),
            CookieHttpOnly = true,
            Provider = new CookieAuthenticationProvider
            {
                OnApplyRedirect = ctx =>
                {
                    if (!ctx.Request.Path.StartsWithSegments(new PathString("/api")))
                    {
                        ctx.Response.Redirect(ctx.RedirectUri);
                    }
                    else
                    {
                        ctx.Response.StatusCode = 401;
                    }
                },

            }
        });

Is this possible to do or is it not working because I'm calling it from a different domain and I cant retrieve the Application cookie?

Dylan
  • 1,068
  • 12
  • 25
  • If you are calling from a different domain and using cookies to authenticate, then it won't work. But subdomains work. See http://stackoverflow.com/questions/1062963/how-do-browser-cookie-domains-work – Ólafur Aron Jan 13 '17 at 14:29
  • Is there another way I can setup OWIN on Application #2, so that I can retrieve something back to app #1? – Dylan Jan 13 '17 at 14:30
  • You should look at token based authentication instead of cookies, see http://www.dotnetcurry.com/aspnet/1223/secure-aspnet-web-api-using-tokens-owin-angularjs – Ólafur Aron Jan 13 '17 at 14:32

0 Answers0