Try our conversational search powered by Generative AI!

Dec 18, 2017
(2 votes)

Web API + Service API + Cookie Auth Gotcha

I ran into an interesting problem while on a past project this year - when we turned on Service API via OWIN, my authorized Web API endpoints were returning a 401. We were using cookie authentication for the Web API endpoints. This baffled me a bit until I peeled back the code for Service API.

When one of the Service API's initialization modules executes, it bypasses the default host authentication by calling SupportDefaultHostAuthentication on the Global HTTP Configuration. This explains why my API endpoints weren't recognizing the logged in user's cookie. I came up with a workaround that ignored this call and used cookie authentication instead. See below - during this project, we were using Episerver 10.9.1, and Service API 3.0.1:

  • Add the following code to your OWIN startup. This code ultimately re-adds cookie auth to the Web API filter pipeline

    GlobalConfiguration.Configuration.Filters.Add(new HostAuthenticationFilter(DefaultAuthenticationTypes.ApplicationCookie));
  • In your API controller, decorate your controller or action with the System.Web.Http's Authorize Attribute

After I made these changes, I was able to access my authorized Web API endpoints. As a quick note, if you do use cookie authentication for your Web API endpoints, you may want to send an antiforgery token to protect against XSRF attacks. In this project, I sent the antiforgery token as a header and created a filter attribute that validated the token against the logged in user's cookie. In case anyone is interested, here was my setup:

  • In my master layout, I included a global antiforgery token. I placed this right after the <body> tag, but you can place this anywhere.

  • In my client side code, I sent the antiforgery token as a header. I called the __RequestVerificationToken.

  • On the server side, I created an attribute called UserValidateAntiForgeryTokenAttribute that inherited from FilterAttribute and IAuthorizationFilter. In the ExecuteAuthorizationFilterAsync method, I grabbed the cookie and token values and validated them against each other.
    public Task<HttpResponseMessage> ExecuteAuthorizationFilterAsync(HttpActionContext actionContext,
                CancellationToken cancellationToken, Func<Task<HttpResponseMessage>> continuation)
                    // get headers
                    var headers = actionContext.Request.Headers;
                    // get cookie value
                    var cookieRvtValue = headers
                        .Select(c => c[AntiForgeryConfig.CookieName])
                    // get header value
                    var headerRvtValue = headers.GetValues("__RequestVerificationToken").FirstOrDefault();
                    // validate
                    AntiForgery.Validate(cookieRvtValue, headerRvtValue);
                    actionContext.Response = new HttpResponseMessage
                        StatusCode = HttpStatusCode.Forbidden,
                        RequestMessage = actionContext.ControllerContext.Request
                    var source = new TaskCompletionSource<HttpResponseMessage>();
                    return source.Task;
                return continuation();
  • Decorate your Web API controller action with the attribute

    public string DoGetAction()
         // do something
         return string.empty;

Thanks for reading. Hope you find this helpful!

Dec 18, 2017


Morten Holmgaard
Morten Holmgaard Jan 29, 2018 12:59 PM

It does not work for me - episerver does not have the same logged in context. What else do you have in web.config and in OWIN startup file?

Please login to comment.
Latest blogs
From Procrastination to Proficiency: Navigating Your Journey to Web Experimentation Certification

Hey there, Optimizely enthusiasts!   Join me in celebrating a milestone – I'm officially a certified web experimentation expert! It's an exhilarati...

Silvio Pacitto | May 17, 2024

GPT-4o Now Available for Optimizely via the AI-Assistant plugin!

I am excited to announce that GPT-4o is now available for Optimizely users through the Epicweb AI-Assistant integration. This means you can leverag...

Luc Gosso (MVP) | May 17, 2024 | Syndicated blog

The downside of being too fast

Today when I was tracking down some changes, I came across this commit comment Who wrote this? Me, almost 5 years ago. I did have a chuckle in my...

Quan Mai | May 17, 2024 | Syndicated blog

Optimizely Forms: Safeguarding Your Data

With the rise of cyber threats and privacy concerns, safeguarding sensitive information has become a top priority for businesses across all...

K Khan | May 16, 2024