title: Identityserver4 and Api Resource in same Asp.net Application
body: <p>If i host my Identityserver4 and the Api in the same Asp.net Application.
  What will be used for authentication for the API Controllers?
  The Cookie from Identityserver or the token which i get from the oidc-client in my SPA application?</p>
  
  <p>I my tests i can access the API, also if i didn't send the token within the angular http reqeuest as long as i have the Cookie...</p>
  
  <p>But is this a correct and save way???
  The MVC Controllers for Identityserver are protected with ValidateAntiforgeryKey, but not the API Controllers.</p>
  
  <p>Does it make sense to host both in the same Application???</p>
  
  <p><strong>Edit:</strong>
  In Details, the API is used for managing the IdentityServer.
  CRUD Operations for Clients, Users, Resources,...</p>
  
  <p>For example:
  The IdentityServer is reachable at <a href="http://localhost:5000" rel="nofollow noreferrer">http://localhost:5000</a>
  I want build an Angular2 SPA Admin UI which is available at <a href="http://localhost:5000/admin" rel="nofollow noreferrer">http://localhost:5000/admin</a></p>
  
  <p>The reason for mentioning ValidateAntiforgeryKey is, because if i only use Cookie Authentication for the CRUD API i should also protect these API'S with ValidateAntiforgerKey, or?</p>