title: asp net core project MVC controllers using Cookie Authentication and api end points using Bearer
body: <p>I am working on a project using ASP .net CORE, where we have Angular 2 and MVC and API, need to be protected by Azure AD.</p>
  
  <p>Home/Index MVC controller will start the Angular 2 SPA and Home/Index need to be protected by cookie authentication. I manage to get the token using the OpenIdConnectAuthentication - OnAuthorizationCodeReceived event. </p>
  
  <p>I need to protect the MVC controllers (there are few more controllers apart from Home/Index) using Cookie based Authentication and API using Bearer Authentication, I can get the token from API to Angular then use that token for each subsequent call to API.</p>
  
  <p>In the near future there will be mobile apps calling the same API end points, using Bearer tokens.</p>
  
  <p>This was my starting point:
  <a href="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appmodel-v2-overview" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appmodel-v2-overview</a></p>
  
  <p><strong>Startup.cs</strong></p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
     services.AddMvc().AddJsonOptions(config =&gt; { config.SerializerSettings.ContractResolver = new DefaultContractResolver(); });
  
     services.AddAuthentication(sharedOptions =&gt; sharedOptions.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme);
  }
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
  {
     app.UseCookieAuthentication(new CookieAuthenticationOptions());
  
     Authority = $"https://login.microsoftonline.com/AAAAA}";
     ClientId = "BBBB";
     ClientSecret = "CCCC";
     Audience = "https://localhost:44333/";
  
     app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
     {
        ClientId = ClientId,
        Authority = Authority,
        PostLogoutRedirectUri = Audience,
        ResponseType = OpenIdConnectResponseType.CodeIdToken,
        GetClaimsFromUserInfoEndpoint = false,
        Events = new OpenIdConnectEvents
        {
          OnTokenValidated = TokenValidated,
          OnRemoteFailure = OnAuthenticationFailed,
          OnAuthorizationCodeReceived = OnAuthorizationCodeReceived
        }
     });
  
       app.UseMvc(....);
  }
  </code></pre>
  
  <p><strong>Question:</strong></p>
  
  <p>How can I configure the API to use just "Bearer" auth and MVC to use Cookies?</p>
  
  <p><strong>Update</strong></p>
  
  <p>Hi Adem
  Thank you for your reply.</p>
  
  <p>I never tired 1st option, will give it a go now.
  but I have tired 2nd option earlier, and just tired it as below.</p>
  
  <p>Added this below  app.UseOpenIdConnectAuthentication(...</p>
  
  <pre><code>app.UseJwtBearerAuthentication(new JwtBearerOptions
  {
     Authority = "https://login.microsoftonline.com/AAAA",
     Audience = "https://BBB.onmicrosoft.com/CCCC"
  });
  </code></pre>
  
  <p>For API Controller <code>[Authorize(ActiveAuthenticationSchemes = "Bearer")]</code></p>
  
  <p>For MVC Controller <code>[Authorize(ActiveAuthenticationSchemes = "Cookies")]</code></p>
  
  <p>When it hits my Home Controller it get this error
  Specified method is not supported.</p>
  
  <p>this Stack Trace
  at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler<code>1.HandleSignInAsync(SignInContext context)
   at Microsoft.AspNetCore.Authentication.AuthenticationHandler</code>1.d__66.MoveNext()
   --- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Http.Authentication.Internal.DefaultAuthenticationManager.d__14.MoveNext()
   --- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler<code>1.&lt;HandleRemoteCallbackAsync&gt;d__6.MoveNext()
   --- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler</code>1.d__5.MoveNext()
   --- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.d__15.MoveNext()
   --- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware<code>1.&lt;Invoke&gt;d__18.MoveNext()
   --- End of stack trace from previous location where exception was thrown ---
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware</code>1.d__18.MoveNext()
   --- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.d__6.MoveNext()</p>
  
  <p>Update 2:
  I have tired configuring 2 different auth for APIand MVC like below</p>
  
  <pre><code>app.UseWhen(context =&gt; 
    context.Request.Path.StartsWithSegments("/api"), appBuilder =&gt;
    {
      app.UseJwtBearerAuthentication(new JwtBearerOptions
      {
        Authority = Authority,
        Audience = Configuration["Authentication:AzureAd:Audience"]
      });
    });
  app.UseWhen(context =&gt; 
    !context.Request.Path.StartsWithSegments("/api"), appBuilder =&gt;
    {
      app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
      {
        ClientId = ClientId,
        Authority = Authority,
        PostLogoutRedirectUri = Audience,
        ResponseType = OpenIdConnectResponseType.CodeIdToken,
        GetClaimsFromUserInfoEndpoint = false,
        Events = new OpenIdConnectEvents
        {
          OnTokenValidated = TokenValidated,
          OnRemoteFailure = OnAuthenticationFailed,
          OnAuthorizationCodeReceived = OnAuthorizationCodeReceived
        }
    });
  });
  </code></pre>
  
  <p>But API still seem to be using the cookie auth. I could still see the the request has cookies in the request.</p>
  
  <p>Thank you
  Asanka</p>