title: What authentication mechanism to use in client app
body: <p>I am working on an ASP.NET MVC client application. User is authenticated and authorized via another API application which returns token. </p>
  
  <p>Currently, after client app recieves token from API, it saves token in session and sets form authentication cookie for app authorization. </p>
  
  <pre><code>FormsAuthentication.SetAuthCookie(TokenViewModel.Username, rememberMe);
  HttpContext.Current.Session["AuthenticationToken"] = TokenViewModel;
  </code></pre>
  
  <p>Should i keep using form authentication, or just save token in session? or user OWIN here to authorize user.</p>
  
  <p>Client app uses [Authorize] attribute.</p>