SignInManager.SignInPasswordAsync is not logging in the User in ApiController

Question

I have an ApiController that handles ajax login requests. Below is what is happening in the code:

// I tried with HttpContext.Current.GetOwinContext().Get... and it didn't work either
private ApplicationUserManager userManager => Request.GetOwinContext().Get<ApplicationManager>();
private ApplicationSignInManager signInManager => Request.GetOwinContext().Get<ApplicationSignInManager>();

public async Task<IHttpActionResult> Login(LoginJson request)
{
    var user = await userManager.FindByEmailAsync(request.Email);
    var result = await signInManager.PasswordSignInAsync(user.UserName, request.Password, true, true);

    if (result == SignInStatus.Success)
    {
        if (!User.Identity.IsAuthenticated)
        {
            throw new Exception("Why are you not authenticating!!!");
        }
    }
    return Ok();
}

That exception is always thrown (i.e. the result is Success and yet IPrincipal reports that user is not authenticated yet).

What is even weirder is that if I reload the page I am taken to the dashboard page (Dashboard is the default home page for authenticated users), meaning the previous request actually did log the user in. But then why would User.Identity.IsAuthenticated return false in my first login request? Any ideas?

Note: this is only happening for ApiController, a normal MVC Controller logs the user in correctly

Answer 1

Authentication cookie is only set when your controller send a reply to a client (browser). And User.Identity.IsAuthenticated is checking if the cookie is set. But you are trying to check if the cookie is set within the same request as where you set the cookie.

In other words you can only check if user is authenticated only on the following request after you call PasswordSignInAsync. So remove that throw new Exception... and you'll be fine.