title: Cross-domain cookie authentication trouble WebApi ASP.NET
body: <p>I want to make ajax request from MVC site to WebApi using cookie authorization.
  BUT
  I've stuck into trouble. </p>
  
  <pre><code>ControllerContext.RequestContext.Principal
  </code></pre>
  
  <p><strong>is null</strong>. It seems it cannot recognize cookies, unless it exists in request.
  I have two applications
  1 - MVC the main
  2 - WebApi additional 
  MVC requests WebApi. Both use common Identity Users.</p>
  
  <p>Here is my implementation</p>
  
  <ol>
  <li><p>Registration for IAppBuilder</p>
  
  <pre><code>    public static void Register(IAppBuilder app)
      {
          app.CreatePerOwinContext(MyDbContext.Create);
          app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create);
          app.UseCookieAuthentication(new CookieAuthenticationOptions()
          {
              AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
              CookieName = ".AspNet.Cookies",
              CookieSecure = CookieSecureOption.Never,
              AuthenticationMode = AuthenticationMode.Active
          });
  
          app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
      }
  </code></pre></li>
  <li><p>My ApplicationManager is:</p>
  
  <pre><code>public class ApplicationUserManager : UserManager&lt;ApplicationUser&gt; {
  public ApplicationUserManager(IUserStore&lt;ApplicationUser&gt; store) : base(store)
  {
  }
  
  public static ApplicationUserManager Create(IdentityFactoryOptions&lt;ApplicationUserManager&gt; options, IOwinContext context)
  {
      var appDbContext = context.Get&lt;MyDbContext&gt;();
      var appUserManager = new ApplicationUserManager(new UserStore&lt;ApplicationUser&gt;(appDbContext));
      return appUserManager;
  } }
  </code></pre></li>
  <li><p>The same machineKeys in WebApi and MVC</p>
  
  <p>&lt;machineKey decryption="AES" decryptionKey="F7F..."
  validation="SHA1" validationKey="DD2..." /&gt;</p></li>
  <li><p>The controller covered with Authorize attribute</p>
  
  <pre><code>[Authorize]
  [EnableCors(origins: "*", headers: "*", methods: "*", SupportsCredentials = true)]
  public sealed class BalanceController : ApiController ...
  </code></pre></li>
  </ol>
  
  <p>Any help please.</p>