title: Log user in manually with Forms Authentication
body: <p>I'm trying to implement token-based authorization for an Asp.Net MVC2 app, and I think my approach is wrong. First off: by token-based authorization I mean that when an unauthenticated user goes to <code>http://myapp.com/some/action?tok=[special single-use token here]</code> they are logged in. </p>
  
  <p>All of the controllers in my app extend a common <code>ApplicationController</code>, so my approach was to override <code>OnAuthorize</code> on that controller as follows:</p>
  
  <pre><code>class ApplicationController
  {
      protected override void OnAuthorization(AuthorizationContext filterContext)
      {
          if (filterContext.HttpContext.Request.QueryString["tok"] != null)
          {
              var token = HttpUtility.UrlDecode(filterContext.HttpContext.Request.QueryString["tok"]);
  
              if ((var user = getUserByToken(token)) != null)
              {
                   FormsAuthentication.SetAuthCookie(user.Email, false);
              }
              else{ /* highly-proprietary handling of invalid token */ }
          }
          base.OnAuthorization(filterContext);
      }
  }
  </code></pre>
  
  <p>I am <em>absolutely certain</em> that <code>SetAuthCookie</code> is being called when it should and not being called when it shouldn't. </p>
  
  <p>The problem is, that doesn't really log the user in. It sets a cookie, which means I'd have to redirect (<code>User.Identity.IsAuthenticated</code> remains false after calling <code>SetAuthCookie</code>.) But the whole idea about this is to continue the request as normal and avoid a pointless redirect. Is there some way to accomplish this goal? It doesn't really seem like a whole lot to ask...</p>