title: ASP.NET MVC / Web API Custom Authentication
body: <p>I have ASP.NET MVC 4 / Web API hybrid application. The authentication is being handled by an existing application. In looking at securing these types of applications, most articles point to using Forms Authentication along with the <code>[Authorize]</code> attribute on the MVC and API controllers/actions you want to protect. I would like to use the <code>[Authorize]</code> attribute as it will handle both MVC routes and API routes but not sure how to do that without having an actual form and using the built-in membership provider.</p>
  
  <p>Should I go with a simple approach like described <a href="https://stackoverflow.com/questions/18594316/custom-authentication-and-asp-net-mvc">here</a>? Or should I create a Custom Membership provider that handles the logic?</p>
  
  <p>For clarity, the workflow would be as follows:</p>
  
  <ol>
  <li>The user logs in through the existing authentication portal.</li>
  <li>If authenticated, they are redirected to my application along with some additional data like username and email (so no passwords need to be transferred)</li>
  <li>My application sets an authentication cookie that allows the user to continue using the application.</li>
  </ol>
  
  <p>Any help would be greatly appreciated.</p>