title: Web API 2: Random 401 unauthorized on POST
body: <p>I'm currently building an Angular 2 + ASP Web API 2 application and came across an annoying authorization issue.</p>
  
  <p>I can create an account and log in using the standard identity framework without any problem using the bearer token, but when I'm trying to POST data to my controller I have a 401 authorization ... which occurs only on the second call.</p>
  
  <p>Here is for example the first POST which worked perfectly fine:</p>
  
  <pre><code>Accept:application/json, text/plain, */*
  Accept-Encoding:gzip, deflate, br
  Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
  Authorization:Bearer 2x4FSZqJ6Msos870_gIl4aKjgdms1PEGNnFp2ptM6Rrgs4vtmvnMdu2nzEfBoly15CI2bQss5DVe-bkN2uSTHrMP7F6blK90DcFt095xTsWk3BJ_5RiZ-jsXOrqTZaisChIbWgGN0o-DiTEA_ojFKImgsX9yip6hloZ6GI_Cd0eg6EjX6S_PUmmyI13oiBAHKROmDvVoB4y0-DbHPnAO--x9yGxU1z_SRwFYqX8Dua7oAvpbyl2VFIqqA39DlQ0E9JPaRC0gvrBxeS-nibAaBeDUwLSAQm6HOe-vynVhQeGrBvHl7r3gicaNdaS5UZvrC43KFTe6__wR1aDaIgpMejlp-eVnjTVbcxvR16XOXrud1W-tNcoOHtoMdGKKb0IvfxK_GCety5eiiTIGWUpA26nF5cCZEIna8ZJawXRiBZVV__MEPDBlR68mJHvHVKfm5w_jupwF5_oehcKwbT_QZ92hxg4UV8uUaiisqbIe7jQ
  Connection:keep-alive
  Content-Length:60
  Content-Type:application/json
  Cookie:.AspNet.Cookies=wcZzztFwOl41pBDgXshPnYCaaQhULRqu9O6grYPDhUx4cSY8PRY1oBRQLs3gPz4ySoxQBaaehtCLDeOFzXAN7q_UMbZps82aCajwvBQewtu_SLizCRTU9UHncWy0EFnJtLAuF5u_8sKW6sNNPTHfDtmjl3UVQkkvYDBceJC5F-sISGqH-sPFwEGmoXgcKLHWfPlejxAvRCRvGbhFhrdKpk_sycoi_B0sBe9Kc8EULXlybEeUolyyrY7L5HvOUIuujLThILt6ipYEmIk8b_2x32uCq7euh5Y_RDzI009SMceOSBs6HYsqUxz6lR2F3KvlcYBQ3rDr8qALhJBnMyJsysdDIruF9dVjK7-IjdEBPXMsGCnHK5gQs_1bIflSaPBbxVPn2VzPui-WChDCdoVXRgGRRnaEtkzaTOhBZIjlLZ1DWS1MqkM-V0khFQxBDqsxll0pZTgNZuwEOLBYoWWiAK9fATXLSmtMYA2UMKoAE0M
  Host:localhost:56762
  Origin:http://localhost:56762
  Referer:http://localhost:56762/tasks/details;id=null
  User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
  </code></pre>
  
  <p>With this data: {Title: "Test", Category: "Test", Entries: []}</p>
  
  <p>And now the one returning a 401 error, performed a few seconds later:</p>
  
  <pre><code>Accept:application/json, text/plain, */*
  Accept-Encoding:gzip, deflate, br
  Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
  Authorization:Bearer 2x4FSZqJ6Msos870_gIl4aKjgdms1PEGNnFp2ptM6Rrgs4vtmvnMdu2nzEfBoly15CI2bQss5DVe-bkN2uSTHrMP7F6blK90DcFt095xTsWk3BJ_5RiZ-jsXOrqTZaisChIbWgGN0o-DiTEA_ojFKImgsX9yip6hloZ6GI_Cd0eg6EjX6S_PUmmyI13oiBAHKROmDvVoB4y0-DbHPnAO--x9yGxU1z_SRwFYqX8Dua7oAvpbyl2VFIqqA39DlQ0E9JPaRC0gvrBxeS-nibAaBeDUwLSAQm6HOe-vynVhQeGrBvHl7r3gicaNdaS5UZvrC43KFTe6__wR1aDaIgpMejlp-eVnjTVbcxvR16XOXrud1W-tNcoOHtoMdGKKb0IvfxK_GCety5eiiTIGWUpA26nF5cCZEIna8ZJawXRiBZVV__MEPDBlR68mJHvHVKfm5w_jupwF5_oehcKwbT_QZ92hxg4UV8uUaiisqbIe7jQ,Bearer 2x4FSZqJ6Msos870_gIl4aKjgdms1PEGNnFp2ptM6Rrgs4vtmvnMdu2nzEfBoly15CI2bQss5DVe-bkN2uSTHrMP7F6blK90DcFt095xTsWk3BJ_5RiZ-jsXOrqTZaisChIbWgGN0o-DiTEA_ojFKImgsX9yip6hloZ6GI_Cd0eg6EjX6S_PUmmyI13oiBAHKROmDvVoB4y0-DbHPnAO--x9yGxU1z_SRwFYqX8Dua7oAvpbyl2VFIqqA39DlQ0E9JPaRC0gvrBxeS-nibAaBeDUwLSAQm6HOe-vynVhQeGrBvHl7r3gicaNdaS5UZvrC43KFTe6__wR1aDaIgpMejlp-eVnjTVbcxvR16XOXrud1W-tNcoOHtoMdGKKb0IvfxK_GCety5eiiTIGWUpA26nF5cCZEIna8ZJawXRiBZVV__MEPDBlR68mJHvHVKfm5w_jupwF5_oehcKwbT_QZ92hxg4UV8uUaiisqbIe7jQ
  Connection:keep-alive
  Content-Length:62
  Content-Type:application/json
  Cookie:.AspNet.Cookies=wcZzztFwOl41pBDgXshPnYCaaQhULRqu9O6grYPDhUx4cSY8PRY1oBRQLs3gPz4ySoxQBaaehtCLDeOFzXAN7q_UMbZps82aCajwvBQewtu_SLizCRTU9UHncWy0EFnJtLAuF5u_8sKW6sNNPTHfDtmjl3UVQkkvYDBceJC5F-sISGqH-sPFwEGmoXgcKLHWfPlejxAvRCRvGbhFhrdKpk_sycoi_B0sBe9Kc8EULXlybEeUolyyrY7L5HvOUIuujLThILt6ipYEmIk8b_2x32uCq7euh5Y_RDzI009SMceOSBs6HYsqUxz6lR2F3KvlcYBQ3rDr8qALhJBnMyJsysdDIruF9dVjK7-IjdEBPXMsGCnHK5gQs_1bIflSaPBbxVPn2VzPui-WChDCdoVXRgGRRnaEtkzaTOhBZIjlLZ1DWS1MqkM-V0khFQxBDqsxll0pZTgNZuwEOLBYoWWiAK9fATXLSmtMYA2UMKoAE0M
  Host:localhost:56762
  Origin:http://localhost:56762
  Referer:http://localhost:56762/tasks/details;id=null
  User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
  </code></pre>
  
  <p>With this data: {Title: "Test2", Category: "Test2", Entries: []}</p>
  
  <p>I see no real differences between my two posts. They basically are the same. When I refresh in the browser, re-log, and do these tests again, it behaves the exact same way: 1st request returns HTTP 200, second HTTP 401.</p>
  
  <p>Here is my controller action:</p>
  
  <pre><code>[HttpPost]
  [Route("Create")]
  [InjectUserIdInServiceFilter]
  public int CreateTask(CreateUpdateTimedTaskViewModel timedTask)
  {
        var model = this.mapper.Map&lt;CreateUpdateTimedTaskViewModel, TimedTask&gt;(timedTask);
        return this.taskService.Create(model);
  }
  </code></pre>
  
  <p>With my controller definition being the following:</p>
  
  <pre><code>[Authorize]
  [RoutePrefix("api/TimedTask")]
  public class TimedTaskController : ApiController
  </code></pre>
  
  <p>Please note that I use the default auto-generated code for the Identity / OAuth / Owin part; I didn't alter its behavior.</p>
  
  <p>Does anybody have any clue about what is happening?</p>
  
  <p>Thanks in advance</p>
  
  <p>T. Thomas</p>