AuthorizeAttribute works for MVC Controller but doesn't for ApiController

Question

I'm relatively new to MVC and WebAPI, so perhaps I'm doing some stupid thinks.

I'm starting my MVC + WebAPI project. I have just configured authentication, but faced a problem: [Authorize] attribute works correctly for MVC controllers and does not for API (returns always 401 error).

I need some special configurations for API? I'm using default ApplicationSignInManager (I mean one from startup project tempalte).

I have removed my Authorize attribute and I can see that in actions of MVC contoller User.Identity contains my signed in user, but API controller doens know nothing about it.

Answer 1

I've figured out what is going on. In the default project template I have WebApiConfig class with following lines:

config.SuppressDefaultHostAuthentication();
config.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));

These lines separates ApiContoller from other app. So removing them was fixed my issue.