title: Accessing User data in WebAPI from Context/Cookie
body: <p><strong>Update:</strong></p>
  
  <p>I have changed my code to <code>FormsAuthentication.SetAuthCookie(_model.UserName, true);</code>. I do have 2 Web.config files, 1 for MVC and the other for WebAPI. In MVC config, I define the </p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="~/Account/Login" timeout="2880" /&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p>Both applications are on the same domain.</p>
  
  <hr>
  
  <p><strong>Update:</strong> Should we even be using cookies in WebAPI?</p>
  
  <hr>
  
  <p>Currently, I have a MVC project which uses forms authentication and a WebAPI project. The problem is that I can't get the user associated with the request in the WebAPI project. I thought this would be possible or perhaps the implementation is wrong?</p>
  
  <p>NB: I put the cookie code in the WebAPI controller method as a test, it's not where it should be.</p>
  
  <p><strong>MVC - handles login request, create auth ticket.</strong></p>
  
  <pre><code>// POST: /Account/Login
  [AllowAnonymous]
  [HttpPost]
  public ActionResult Login(LoginModel _model, string _returnUrl)
  {
      if (ModelState.IsValid)
      {
          if (Membership.ValidateUser(_model.UserName, _model.Password))
          {
              FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(_model.UserName, true, 15);
              string encryptedTicket = FormsAuthentication.Encrypt(ticket);
              HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
              Response.Cookies.Add(cookie);
  
              // set redirect
          }
      }
  
      // If we got this far, something failed, redisplay form
      return View(_model);
  }
  </code></pre>
  
  <p><strong>WebAPI - handles update request</strong></p>
  
  <pre><code>[AcceptVerbs("PUT")]
  public HttpResponseMessage UpdateInfo(int _id, ExampleModel _model)
  {
      try
      {
          HttpCookie authCookie = HttpContext.Current.Request.Cookies[FormsAuthentication.FormsCookieName];
  
          if (authCookie != null)
          {
              string encTicket = authCookie.Value;
  
              if (!String.IsNullOrEmpty(encTicket))
              {
                  // decrypt the ticket if possible.
                  FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(encTicket);
  
                  var userData = ticket.UserData;
              }
          }
  
          // do update
          return Request.CreateResponse(HttpStatusCode.OK, data, GlobalConfiguration.Configuration);
      }
      catch (Exception err)
      {
          m_logger.Error(err);
          throw;
      }
  }
  </code></pre>