c# - OWIN - token based authentication on classic MVC web application? -

to honest, don't seem grasp owin concept - first library can't seem understand no matter try :(

now problem...

i have 2 mvc apps - 1 uses webapi , 1 don't. webapi app uses token based authentication , works, right i'm trying implement authentication in second (non webapi) app , don't know how it. tried using token code webapi app, realised token generator can't called directly in mvc controller, ended like:

[httppost] public actionresult login(loginmodel logindata) {     string baseurl = request.url.getleftpart(uripartial.authority);      string resultcontent = "";     using (var client = new httpclient())     {         client.baseaddress = new uri(request.url.getleftpart(uripartial.authority));         var content = new formurlencodedcontent(new[]          {             new keyvaluepair<string, string>("grant_type", logindata.grant_type),             new keyvaluepair<string, string>("company", logindata.company),             new keyvaluepair<string, string>("password", logindata.password),             new keyvaluepair<string, string>("username", logindata.username)         });          var result = client.postasync("/token", content).result;         resultcontent = result.content.readasstringasync().result;     }      string access_token = jsonconvert.deserializeobject<dynamic>(resultcontent).access_token;     if(tempdata.keys.contains("token"))     {         tempdata.remove("token");     }     tempdata.add("token", access_token);      httpcookie cookie = new httpcookie("token", access_token);     cookie.expires = datetime.now.adddays(-1);      httpcontext.response.setcookie(cookie);      if(logindata.fromurl != null)     {         return redirect(string.format("{0}{1}", baseurl, logindata.fromurl));     }     else     {         return redirect(string.format("{0}", baseurl));     } } 

(while above works it's ugly hell - not mention error prone.)

then struggled, how inject token every request made controller, ended this:

protected override void onauthorization(authorizationcontext filtercontext) {     var token = this.request.cookies["token"].value;      this.request.headers.add("authorization", string.format("bearer {0}", token));      base.onauthorization(filtercontext); } 

but doesn't seems work. don't know if approach correct (looking @ - it's not...) - questions are:

1. should token based approach used @ non webapi, mvc apps?
2. if - there better way this, or need write "spaghetti code" 1 above generated access token? i'm trying use have 1 universal authentication approach, instead of many - perhaps cookie based approach should used instead?
3. i'm trying use have 1 universal authentication approach, instead of many - perhaps cookie based approach should used instead?

i tried following owin tutorials build in mvc applications, didn't find single example of mixing token classic web app - unless count angularjs tutorials, sadly don't apply here.

i think cookie based approach more apt. doing way work needed, noticed. have @ aad samples, starting point using owin authentication. particularly, recommend taking @ https://github.com/azureadsamples/webapp-webapi-openidconnect-dotnet, todolistservice webapi project , uses token based authentication, todolistwebapp non webapi project uses cookie based approach. there lot of other samples in repo might of interest.