title: Accessing a secure Web API from a WPF client
body: <p>I have a Web API project which is configured for CORS and implements [Authorize] on one of the APIControllers. I can access the API from the WPF client when I remove the [Authorize] but when it's in place the call seems to get lost. This is what I have setup to request a token.</p>
  
  <p>In the WPF code behind</p>
  
  <pre><code>    internal void RefreshRecentFilesList()
      {
          //Get the token
          var token = GetAPIToken(email, password, "http://localhost:50006").Result;
          MessageBox.Show(token);
      }
  
      private static async Task&lt;string&gt; GetAPIToken(string userName, string password, string apiBaseUri)
      {
          using (var client = new HttpClient())
          {
              //setup client
              client.BaseAddress = new Uri(apiBaseUri);
              client.DefaultRequestHeaders.Accept.Clear();
              client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
              //client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", Token.AccessToken);
  
              //setup login data
              var formContent = new FormUrlEncodedContent(new[]
               {
               new KeyValuePair&lt;string, string&gt;("grant_type", "password"), 
               new KeyValuePair&lt;string, string&gt;("username", userName), 
               new KeyValuePair&lt;string, string&gt;("password", password), 
               });
  
              //send request
              HttpResponseMessage responseMessage = await client.PostAsync("/Token", formContent);
  
              //get access token from response body
              var responseJson = await responseMessage.Content.ReadAsStringAsync();
              var jObject = JObject.Parse(responseJson);
              return jObject.GetValue("access_token").ToString();
          }
      }
  </code></pre>
  
  <p>In the Web API project
  WebAPIConfig.cs</p>
  
  <pre><code>        //Enable CORS
          var cors = new EnableCorsAttribute("*", "*", "GET");
          config.EnableCors(cors);
  </code></pre>
  
  <p>In the API controller</p>
  
  <pre><code>    [HttpGet]
      //[Authorize]
      public List&lt;FileInfo&gt; GetFileTypes()
      {
          List&lt;FileInfo&gt; fileInfos = new List&lt;FileInfo&gt;();
          ...
  </code></pre>
  
  <p>In the StartAuth.cs </p>
  
  <pre><code>public void ConfigureAuth(IAppBuilder app)
      {
          // Configure the db context and user manager to use a single instance per request
          app.CreatePerOwinContext(ApplicationDbContext.Create);
          app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create);
  
          // Enable the application to use a cookie to store information for the signed in user
          // and to use a cookie to temporarily store information about a user logging in with a third party login provider
          app.UseCookieAuthentication(new CookieAuthenticationOptions());
          app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
  
          // Configure the application for OAuth based flow
          PublicClientId = "self";
          OAuthOptions = new OAuthAuthorizationServerOptions
          {
              TokenEndpointPath = new PathString("/Token"),
              Provider = new ApplicationOAuthProvider(PublicClientId),
              AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
              AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
              // In production mode set AllowInsecureHttp = false
              AllowInsecureHttp = true
          };
  
          // Enable the application to use bearer tokens to authenticate users
          app.UseOAuthBearerTokens(OAuthOptions);
  </code></pre>
  
  <p>When I run the WPF and step through the code it's getting to the send request line and then just hangs.</p>
  
  <p>Can anyone point me in the right direction please?</p>
  
  <p>Many thanks</p>