title: Implementing Authentication and role based authorization in ASP.NET MVC web API service and MVC client architecture
body: <p>I'm having hard time in deciding an approach while implementing Authentication/Authorization scenario for my Web API (Service) - MVC (client) architecture project. Even though i have implemented Custom token based authentication in Web API project, I'm finding it hard where exactly i should implement the authorization (In Client or in API itself).  </p>
  
  <hr>
  
  <p><strong>Architecture Overview :</strong>  </p>
  
  <ul>
  <li>Projects Solution -<br>
  |<br>
  | __ ASP.NET Web API based REST service (Independently hosted on IIS at M/C 1)<br>
  |<br>
  | __ ASP.NET MVC based Client (independently hosted on IIS at M/C 2 Consuming REST service)<br>
  |<br>
  | __ Smart phone client Application (Consuming the REST service)  </li>
  </ul>
  
  <p><em>Already implemented authentication :</em>  </p>
  
  <ul>
  <li><p>Token based authentication in Web API (using Message Handler) - Which generates SHA1 encripted token for authenticated user which needs to be a part of every http request header for authentication.<br>
  (Token = User Name +  User IP)</p></li>
  <li><p>SSL protected HTTP request. (Again, Using Message Handler)</p></li>
  </ul>
  
  <p><em>Current problems :</em></p>
  
  <ol>
  <li>At what layer the authorization should be implemented?</li>
  <li>How does user role should be persisted at client? Using Cookies? or Adding role information to Token itself ( Which might add overhead for API to decrypt the information and extra DB calls to retrieve permissions associated with that role)</li>
  <li>How the Authentication Token should be persisted with Client session?</li>
  <li>Since, my application is SPA MVC application, What is the best way to include the Authentication token as a part of every AJAX call i make to API?</li>
  </ol>
  
  <hr>
  
  <p>I hope, I'm not doing things wrong while taking the whole authentication/authorization concept in to consideration. Thus, I'll appreciate any alternate approach/suggestion.</p>