ASP.NET 5 (vNext) Web API: How to build authorization header?
<p>I am currently learning Web API for ASP.NET 5 and therefore implemented a very simple application including user authorization / authentication with the Identity framework.</p>

<p>The login method of my AccountController which handles registration and login looks like this:</p>

<pre><code>[HttpPost("[action]/{username};{password}")]
    public async Task&lt;IActionResult&gt; Login(string username, string password)
    {
        var result = await _signInManager.PasswordSignInAsync(username, password, false, lockoutOnFailure: false);

        if (result.Succeeded)
        {
            Logger.LogInformation(1, "User logged in.");
            return new HttpOkResult();
        }

        return new BadRequestResult();
    }
</code></pre>

<p>When I perform a login, I get a HTTP result which contains a cookie that looks like this:</p>

<pre><code>Set-Cookie: .AspNet.Microsoft.AspNet.Identity.Application=CfDJ8 [...] 2XQ; path=/; httponly
</code></pre>

<p>I assume, the cookie contains the token I have to add to a HTTP request whenever I want to access a controller or method decorated with some sort of <strong>[Authorize]</strong> attribute.</p>

<p>However, I am unsure how a valid HTTP request containing this token has to look like. I have tried the following request which did not do the trick:</p>

<pre><code>GET http://localhost:9466/api/videogames/GetAll HTTP/1.1
User-Agent: Fiddler
Host: localhost:9466
Authorization: bearer CfDJ8 [...] 2XQ
</code></pre>

<p>Maybe the following log snippet from a failed authorization might be of help:</p>

<pre><code>[10.03.2016 12:44:30] Information: [Microsoft.AspNet.Hosting.Internal.HostingEngine] Request starting HTTP/1.1 GET http://localhost:9466/api/videogames/GetAll  
[10.03.2016 12:44:30] Warning: [Microsoft.AspNet.Mvc.Controllers.ControllerActionInvoker] Authorization failed for the request at filter 'Microsoft.AspNet.Mvc.Filters.AuthorizeFilter'.
[10.03.2016 12:44:30] Information: [Microsoft.AspNet.Authentication.Cookies.CookieAuthenticationMiddleware] AuthenticationScheme: Microsoft.AspNet.Identity.Application was challenged.
[10.03.2016 12:44:30] Information: [Microsoft.AspNet.Mvc.ChallengeResult] Executing ChallengeResult with authentication schemes ().
[10.03.2016 12:44:30] Information: [Microsoft.AspNet.Mvc.Infrastructure.MvcRouteHandler] Executed action VideoGameStoreWebApi.Controllers.VideoGamesController.GetAll in 0ms
[10.03.2016 12:44:30] Information: [Microsoft.AspNet.Hosting.Internal.HostingEngine] Request finished in 0ms 302 
[10.03.2016 12:44:30] Information: [Microsoft.AspNet.Hosting.Internal.HostingEngine] Request starting HTTP/1.1 GET http://localhost:9466/Account/Login?ReturnUrl=%2Fapi%2Fvideogames%2FGetAll  
[10.03.2016 12:44:30] Information: [Microsoft.AspNet.Hosting.Internal.HostingEngine] Request finished in 0ms 404 
</code></pre>

<p>Is there an error in how I add the token to the HTTP request or is there a more basic problem in how the identity framework handles user authorization i am not aware of?</p>

<p>Thanks in advance for your answers!</p>