title: Basic Token authentification and authorization on Web.Api
body: <p>So I have an MVC Application that calls WebApi method. </p>
  
  <p>My Authorization on MVC App is done like this</p>
  
  <pre><code>  public class CustomAuthorizeAttribute : AuthorizeAttribute {
  
          private RolesEnum _role;
  
          public CustomAuthorizeAttribute() {
              _role = RolesEnum.User;
          }
  
          public CustomAuthorizeAttribute(RolesEnum role) {
              _role = role;
          }
  
          protected override bool AuthorizeCore(HttpContextBase httpContext) {
  
              User currentUser = (User)httpContext.Session["CurrentUser"];
  
              if (currentUser == null) {
                  return false;
              }
  
              if (currentUser.Role == RolesEnum.User &amp;&amp; _role == RolesEnum.Admin) {
                  return false;
              }
  
              return true;
          }
  </code></pre>
  
  <p>The authentification is done calling a WebApi method</p>
  
  <pre><code>[HttpPost]
      public ActionResult Login(string username, string password)
      {
  
          User acc = new User();
          acc.Username = username;
          acc.Password = password;
          acc = accBL.Login(acc);
  
          if (acc != null) {
              Session.Add("CurrentUser", acc);
              return  RedirectToAction("Index", "Project", null);
          } else {
              return View();
          }
  
  
      }
  </code></pre>
  
  <p>Login method looks like this</p>
  
  <pre><code>  public User LogIn(User acc) {
              try {
                  HttpClient client = new HttpClient();
                  client.BaseAddress = new Uri(BASE_URL);
                  client.DefaultRequestHeaders.Accept.Add(
                     new MediaTypeWithQualityHeaderValue("application/json"));
                  HttpResponseMessage response = client.PostAsJsonAsync("api/Account/Login", acc).Result;
  
                  if (response.IsSuccessStatusCode) {
                      return response.Content.ReadAsAsync&lt;User&gt;().Result;
                  } else {
                      return null;
                  }
  
              } catch {
                  return null;
              }
          }
  </code></pre>
  
  <p>And WebApi method looks like this</p>
  
  <pre><code> [Route("api/Account/Login")]
          [HttpPost]
          public IHttpActionResult Login(User userModel) {
              User user = db.Users.Where(p =&gt; p.Username == userModel.Username &amp;&amp; p.Password == userModel.Password).FirstOrDefault();
  
              if (user != null) {
                  return Ok(user);
              } else {
                  throw new HttpResponseException(HttpStatusCode.Unauthorized);
              }
  
          }
  </code></pre>
  
  <p>How can I make a connection between the MVC App and the WebApi Services. My authorization and authentification works on MVC part, but my WebApi Services can be called without this any authorization/authenification. How can I secure my WebApi too based on my example? I've been working for about 3 weeks with MVC and WebApi and many things are not very clear too me. </p>
  
  <p>Should I just create a GUID in  public IHttpActionResult Login(User userModel) and check for it everytime i a method is called? How do i pass this GUID to MVC App and from MVC to WebApi? </p>