{"action":"created","issue":{"url":"https://api.github.com/repos/MohammadYounes/OWIN-MixedAuth/issues/18","labels_url":"https://api.github.com/repos/MohammadYounes/OWIN-MixedAuth/issues/18/labels{/name}","comments_url":"https://api.github.com/repos/MohammadYounes/OWIN-MixedAuth/issues/18/comments","events_url":"https://api.github.com/repos/MohammadYounes/OWIN-MixedAuth/issues/18/events","html_url":"https://github.com/MohammadYounes/OWIN-MixedAuth/issues/18","id":72408917,"number":18,"title":"ApiController requests are unauthenticated","user":{"login":"TrabacchinLuigi","id":136717,"avatar_url":"https://avatars.githubusercontent.com/u/136717?v=3","gravatar_id":"","url":"https://api.github.com/users/TrabacchinLuigi","html_url":"https://github.com/TrabacchinLuigi","followers_url":"https://api.github.com/users/TrabacchinLuigi/followers","following_url":"https://api.github.com/users/TrabacchinLuigi/following{/other_user}","gists_url":"https://api.github.com/users/TrabacchinLuigi/gists{/gist_id}","starred_url":"https://api.github.com/users/TrabacchinLuigi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TrabacchinLuigi/subscriptions","organizations_url":"https://api.github.com/users/TrabacchinLuigi/orgs","repos_url":"https://api.github.com/users/TrabacchinLuigi/repos","events_url":"https://api.github.com/users/TrabacchinLuigi/events{/privacy}","received_events_url":"https://api.github.com/users/TrabacchinLuigi/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/MohammadYounes/OWIN-MixedAuth/labels/question","name":"question","color":"0052cc"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-01T11:14:12Z","updated_at":"2015-05-01T11:25:59Z","closed_at":"2015-05-01T11:25:59Z","body":"i've installed this middleware with nuget on an MVC5 with controller AND ApiControllers\r\nthe default configuration for ApiController include those two lines that seems to prevent the authentication to work. Commenting them out seems to get things back to normality, but i wonder if this is a correct behaviour.\r\n\r\n    // App_Start\\WebApiConfig.cs\r\n    \r\n    // Web API configuration and services\r\n    // Configure Web API to use only bearer token authentication.\r\n    config.SuppressDefaultHostAuthentication();\r\n    config.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));\r\n\r\nplease note that, adding an ApiController later does not create those two lines, but creating a new project with both mvc and api does."},"comment":{"url":"https://api.github.com/repos/MohammadYounes/OWIN-MixedAuth/issues/comments/98106561","html_url":"https://github.com/MohammadYounes/OWIN-MixedAuth/issues/18#issuecomment-98106561","issue_url":"https://api.github.com/repos/MohammadYounes/OWIN-MixedAuth/issues/18","id":98106561,"user":{"login":"MohammadYounes","id":4712046,"avatar_url":"https://avatars.githubusercontent.com/u/4712046?v=3","gravatar_id":"","url":"https://api.github.com/users/MohammadYounes","html_url":"https://github.com/MohammadYounes","followers_url":"https://api.github.com/users/MohammadYounes/followers","following_url":"https://api.github.com/users/MohammadYounes/following{/other_user}","gists_url":"https://api.github.com/users/MohammadYounes/gists{/gist_id}","starred_url":"https://api.github.com/users/MohammadYounes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MohammadYounes/subscriptions","organizations_url":"https://api.github.com/users/MohammadYounes/orgs","repos_url":"https://api.github.com/users/MohammadYounes/repos","events_url":"https://api.github.com/users/MohammadYounes/events{/privacy}","received_events_url":"https://api.github.com/users/MohammadYounes/received_events","type":"User","site_admin":false},"created_at":"2015-05-01T11:25:59Z","updated_at":"2015-05-01T11:25:59Z","body":"These are used to enable suppression of the host's default authentication, Forcing your Web API to use only bearer tokens for authentication.\r\n\r\nThis means you must first get an Access Token, then send an Authorization header with each API call `Authorization: Bearer imSXTs2OqSrGWzsFQhIXziFCO3rF...` \r\n\r\nYou can find more details and a sample [here](http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api).\r\n\r\n"}}