title: Web API - Authentication Advice
body: <p>Background:
  - Using Web API in a Web Forms app with ASP.Net 4.0/C# using VS 2012
  - Some pages will use Web API calls with JQuery, others will use web forms postbacks</p>
  
  <p>Need to do the following:</p>
  
  <ul>
  <li>Have user login with username/password</li>
  <li>Validate credentials with SQL Server DB</li>
  <li>Generate token back to client</li>
  <li>Have client use token to authenticate on future API requests</li>
  <li>Maintain user session regardless if using Web API or web form postback</li>
  </ul>
  
  <p>What I'm not clear about is:</p>
  
  <ul>
  <li>How to generate token using Web API</li>
  <li>How to validate the token server-side on each call (store in SQL Server?)</li>
  <li>How to maintain user session with a mix of Web API/web form postbacks</li>
  </ul>