title: WebAPI + SimpleMembership + WebSecurity - can never authenticate?
body: <p>I'm trying to implement a single-page app.  I carried over some of my working code from another project (MVC4) to implement authentication.  Right now I see cookies being set, but <code>WebSecurity</code> / <code>User.Identity</code> do not seem to be working for some reason.  After logging in, subsequent requests <em>never</em> validate as authenticated, either via <code>WebSecurity.IsAuthenticated</code>, or <code>User.Identity.IsAuthenticated</code>.  Does anyone know why this is happening? </p>
  
  <p>Controller code: </p>
  
  <pre><code>public class AccountController : ApiController {
  
      private readonly UserService _userService;
  
      public AccountController() {}
  
      public AccountController(UserService userService) {
          _userService = userService;
      }
  
      [AllowAnonymous]
      [HttpGet]
      [Route("api/authpayload")]
      // This gets called when the app loads.  Always, User.Identity.IsAuthenticated is false. 
      public HttpResponseMessage AuthPayload() {
          var payload = new AuthPayloadDto();
          try {
              var userId = WebSecurity.GetUserId(User.Identity.Name);
              if (User.Identity.IsAuthenticated &amp;&amp; userId &gt; 0) {
                  payload.Username = User.Identity.Name;
              } else {
                  LogOut();
                  payload.IsAuthenticated = false;
              }
              return Request.CreateResponse(HttpStatusCode.OK, payload);
          } catch (Exception e) {
              return Request.CreateResponse(HttpStatusCode.InternalServerError, e);
          }
      }
  
      [HttpPost]
      [Route("api/login")]
      [AllowAnonymous]
      public HttpResponseMessage LogIn(LoginModel model) {
          if (!ModelState.IsValid)
              return Request.CreateErrorResponse(HttpStatusCode.BadRequest, ModelState);
          try {
              if (WebSecurity.IsAuthenticated)
                  return Request.CreateResponse(HttpStatusCode.Conflict, "already logged in.");
              if (!WebSecurity.UserExists(model.Username))
                  return Request.CreateResponse(HttpStatusCode.Conflict, "User does not exist.");
              if (WebSecurity.Login(model.Username, model.Password, persistCookie: model.RememberMe)) {
                  // This code always gets hit when I log in, no problems.  I see a new cookie get sent down as well, using Chrome debugger.
                  var payload = new AuthPayloadDto();
                  return Request.CreateResponse(HttpStatusCode.OK, payload);
              }
              LogOut();
              return Request.CreateResponse(HttpStatusCode.Forbidden, "Login Failed.");
          } catch (Exception e) {
              return Request.CreateResponse(HttpStatusCode.InternalServerError, e);
          }
      }
  </code></pre>
  
  <p>Web.config: </p>
  
  <pre><code>&lt;system.web&gt;
      &lt;compilation debug="true" targetFramework="4.5" /&gt;
      &lt;httpRuntime targetFramework="4.5" /&gt;
      &lt;authentication mode="Forms"&gt;
        &lt;forms loginUrl="~/" timeout="2880" /&gt;
      &lt;/authentication&gt;
      &lt;roleManager enabled="true" defaultProvider="simple"&gt;
        &lt;providers&gt;
          &lt;clear /&gt;
          &lt;add name="simple" type="WebMatrix.WebData.SimpleRoleProvider, WebMatrix.WebData" /&gt;
        &lt;/providers&gt;
      &lt;/roleManager&gt;
      &lt;membership defaultProvider="simple"&gt;
        &lt;providers&gt;
          &lt;clear /&gt;
          &lt;add name="simple" type="WebMatrix.WebData.SimpleMembershipProvider, WebMatrix.WebData" /&gt;
        &lt;/providers&gt;
      &lt;/membership&gt;
      &lt;!--
              If you are deploying to a cloud environment that has multiple web server instances,
              you should change session state mode from "InProc" to "Custom". In addition,
              change the connection string named "DefaultConnection" to connect to an instance
              of SQL Server (including SQL Azure and SQL  Compact) instead of to SQL Server Express.
        --&gt;
      &lt;sessionState mode="InProc" customProvider="DefaultSessionProvider"&gt;
        &lt;providers&gt;
          &lt;add name="DefaultSessionProvider" type="System.Web.Providers.DefaultSessionStateProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="DefaultConnection" /&gt;
        &lt;/providers&gt;
      &lt;/sessionState&gt;
  
    &lt;/system.web&gt;
  </code></pre>
  
  <p>The cookie that gets sent after login is not expired, and it does get sent back on subsequent requests, but <code>IsAuthenticated</code> is always false.  What am I doing wrong?</p>
  
  <p>Update: </p>
  
  <p>I updated my web.config to the following to get everything working: </p>
  
  <pre><code>&lt;system.web&gt;
      &lt;authentication mode="None" /&gt;
      &lt;compilation debug="true" targetFramework="4.5" /&gt;
      &lt;httpRuntime targetFramework="4.5" /&gt;
      &lt;roleManager enabled="true" defaultProvider="SimpleRoleProvider"&gt;
        &lt;providers&gt;
          &lt;clear /&gt;
          &lt;add name="SimpleRoleProvider" type="WebMatrix.WebData.SimpleRoleProvider, WebMatrix.WebData" /&gt;
        &lt;/providers&gt;
      &lt;/roleManager&gt;
      &lt;membership defaultProvider="SimpleMembershipProvider"&gt;
        &lt;providers&gt;
          &lt;clear /&gt;
          &lt;add name="SimpleMembershipProvider" type="WebMatrix.WebData.SimpleMembershipProvider, WebMatrix.WebData" /&gt;
        &lt;/providers&gt;
      &lt;/membership&gt;
    &lt;/system.web&gt;
  </code></pre>
  
  <p>But I'd like to leave this open in case anyone has an explanation of why this works; I'm pretty lost.  </p>