title: ASP.NET MVC 4 Web API Authentication with Membership Provider
body: <p>I have an ASP.NET MVC 4 Project using the Web API. On the controller I have set the class to require authorization using the [Authorize] attribute. For Authentication I am using the ASP.NET Membership Provider and have my Web.Config set to use "Forms" Authentication. Here is where I am stuck:</p>
  
  <p>Everything is working great up until the point that I am done with testing the API and I want to secure the controller with the [Authorize] attribute so I can start testing authentication against users in my Membership Provider. So I fire up Fiddler and make the same call adding the Authorization:Basic attribute along with a username:password from my membership provider like so:</p>
  
  <p><img src="https://i.stack.imgur.com/t00T6.png" alt="enter image description here"></p>
  
  <p>The response I get is 401 unauthorized and under "Auth" I get "No WWW-Authenticate Header is present." Then I realize that the API is looking for an SHA1 encoded key. So I fire up an SHA1 generator from a search and get a hash for my username:password and update my Request Header like so:</p>
  
  <p><img src="https://i.stack.imgur.com/6zGG4.png" alt="enter image description here"></p>
  
  <p>This does not work either and I get the same results. Also I obviously need some sort of "shared secret key" to use with the server to decode my username/password.</p>
  
  <p>So my questions:</p>
  
  <ol>
  <li>How do I get this key from the server (or in this case Virtual IIS running off VS 2012).</li>
  <li>How do I use this to make Authenticated calls in Fiddler using usernames/passwords from an ASP.NET Membership Provider.</li>
  <li>How will I use this in my client application to make the same calls (C# WPF App).</li>
  <li>Is this best practive when combined with SSL on my HTTP calls? If not what is?</li>
  </ol>
  
  <p>Thanks in advance!</p>