Forms authentication for Web API invalidated by external assembly? <p>We have a site that uses Forms-authentication through a custom MembershipProvider and Web API that we're now having an unexpected problem with. </p> <p>The site uses EPiServer CMS, but I think the problem is general enough that the question can probably be answered without any knowledge of EPiServer. </p> <p>The problem started when we upgraded EPiServer to the latest version - this also gave us a new assembly for their Service API which basically is a REST API for integrating with their CMS that is setup on a specific route on the site automatically - just by including the assembly in the bin-folder. </p> <p>This new version of their Service API uses OWIN and configures their API to use Bearer-authentication and as far as I can understand also ClaimsIdentity, which would be fine except this suddenly also applies to <em>our</em> implementation of Web API, causing the HttpContext.Current.User to be a ClaimsIdentiy that's not authenticated. Removing the Service API-assembly makes it a FormsIdentity again. </p> <p>The Forms-authentication continues to work fine on the website itself, it is just the WebAPI that is affected by this. </p> <p>So we're looking for a way to fix this, any ideas would be greatly appreciated!</p>