title: Combine the use of authentication both for MVC pages and for Web API pages?
body: <p>I have an MVC 5 web application and can login with a Login.cshtml page and get a cookie and the login works fine. But, I would like to do a login with the Web API and then (maybe) set a cookie so that I am logged in for my MVC pages... (or login with the MVC login and then access the Web API) however the web api returns a bearer token and not a cookie token... so this doesn't work. Is there a way to combine the use of authentication both for my MVC pages and for my Web API pages?</p>
  
  <p>UPDATE:</p>
  
  <p>This isn't really a code issue, more of a conceptual issue.</p>
  
  <p>Normal MVC web pages examine a cookie named, by default, ".AspNet.ApplicationCookie" to determine the requesters identity. This cookie is generated by calling ApplicationSignInManager.PasswordSignInAsync.</p>
  
  <p>WebAPI calls, on the other hand, examine the requests headers for an item named Authorization... and uses that value to determine the requesters identity. This is returned from a WebAPI call to "/Token".</p>
  
  <p>These are very different values. My website needs to use both MVC pages <em>and</em> WebAPI calls (to dynamically update those pages)... and both need to be authenticated to perform their tasks.</p>
  
  <p>The only method I can think of is to actually authenticate twice... once with a WebAPI call and again with the Login post. (see my Answer below).</p>
  
  <p>This seems very hacky... but I don't understand the authorization code enough to know if there is a more proper way of accomplishing this.</p>