title: Web API 2 OWIN Bearer Token purpose of cookie?
body: <p>I am trying to understand the new OWIN Bearer Token authentication process in the Single Page App template in MVC 5.  Please correct me if I'm wrong, for the OAuth password client authentication flow, Bearer Token authentication works by checking the http authorization request header for the Bearer access token code to see if a request is authenticated, it doesn't rely on cookie to check if a particular request is authenticated.</p>
  
  <p>According to this post:</p>
  
  <p><a href="https://blogs.msdn.microsoft.com/webdev/2013/09/20/understanding-security-features-in-the-spa-template-for-vs2013-rc/" rel="nofollow noreferrer">OWIN Bearer Token Authentication with Web API Sample</a></p>
  
  <pre class="lang-cs prettyprint-override"><code>public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
  {
      using (IdentityManager identityManager = _identityManagerFactory.CreateStoreManager())
      {
          if (!await identityManager.Passwords.CheckPasswordAsync(context.UserName, context.Password))
          {
              context.SetError("invalid_grant", "The user name or password is incorrect.");
              return;
          }
  
          string userId = await identityManager.Logins.GetUserIdForLocalLoginAsync(context.UserName);
          IEnumerable&lt;Claim&gt; claims = await GetClaimsAsync(identityManager, userId);
          ClaimsIdentity oAuthIdentity = CreateIdentity(identityManager, claims,
              context.Options.AuthenticationType);
          ClaimsIdentity cookiesIdentity = CreateIdentity(identityManager, claims,
              _cookieOptions.AuthenticationType);
          AuthenticationProperties properties = await CreatePropertiesAsync(identityManager, userId);
          AuthenticationTicket ticket = new AuthenticationTicket(oAuthIdentity, properties);
          context.Validated(ticket);
          context.Request.Context.Authentication.SignIn(cookiesIdentity);
      }
  }
  </code></pre>
  
  <p>The GrantReourceOwnerCredentials function not only compose the ticket with this line: context.Validated(ticket); but it also compose a cookie identity and set it to the cookie with this line: context.Request.Context.Authentication.SignIn(cookiesIdentity);</p>
  
  <p>So my questions are, what is the exact purpose of the cookie in this function?  Shouldn't the AuthenticationTicket be good enough for authentication purpose?</p>