MVC application Authorization for ApiController doesn't work - asp.net-mvc

Question

I'm building an MVC application that has standard Controllers and APIControllers in the same project. All functionality works fine, I can call Controllers or APIControllers no issues.
What I'm trying to achieve is to make sure that if you call /api/products from outside it shouldn't be accessible, only authorized users can call it.
I added and Authorize attribute to my api controller and I still can call it and get results from a client application like Postman. You can see my code below.
[Authorize] //System.Web.Http
public class ProductsController : ApiController
[HttpGet]
public IHttpActionResult Get()
Here is what I have in my Startup.Auth.cs file.
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
LoginPath = new PathString("/Account/Login"),
Provider = new CookieAuthenticationProvider
{
// Enables the application to validate the security stamp when the user logs in.
// This is a security feature which is used when you change a password or add an external login to your account.
OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
validateInterval: TimeSpan.FromMinutes(30),
regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
}
});
If I commented out this code, I get a proper response from the APIController, but I also cannot login.
<Error>
<Message>Authorization has been denied for this request.</Message>
</Error>
Not sure what I'm missing. Per my understanding I don't need to create a custom Filter for my API controllers, I should be able to use a built in Authorization functionality. Let me know if you need more details or code samples.

Answer 1

I think that the auth for your MVC controllers is defined by Startup.Auth.cs while for the API controllers is at WebApiConfig.cs.
Make sure that on WebApiConfig.cs in the Register() method you have a call to config.SuppressDefaultHostAuthentication(); which prevents the configured authentication method on your MVC controllers to work on ApiController calls.
Also note that you must need, in certain cases, to add the [AllowAnonymous] attribute in some API calls like login, register, etc.

Answer 2

Interesting findings. I tried to call the API Controllers that are required authentication from within the application without authorization and I received a proper response, Not Authorized. I tried to call the API endpoint using Fiddler, the same result.
So for some reason, Postman still can get results without any errors. I created even a new API endpoint the same behavior. I'm going to refrain from using the Postman because even it's a great tool it creates a lot of confusion, and as a result, I wasted a few hours.
Hopefully, my example is going to save somebody else time.