ASP.NET Web API Security Essentials

Combining authentication filters with host-level authentication

Authentication at host level will be carried out by the host, such as IIS, itself even before the request reaches the Web API framework. We can disable the host-level authentication in Web API by calling the config.SuppressHostPrincipal() method in the Web API configuration as given in the following:

public static class WebApiConfig
{
    public static void Register(HttpConfiguration config)
    {
        config.SuppressHostPrincipal();
    }
}

It is best practice to disable the host-level authentication in Web API and enable it for the rest of the application. Once the host-level authentication is disabled, we can apply the authentication filter that was created in the earlier section at application level, ...