ASP.NET Core WebAPI Cookie + JWT Authentication : <p>we have a SPA (Angular) with API backend (ASP.NET Core WebAPI):</p>

<p>SPA is listens on <code>app.mydomain.com</code>, API on <code>app.mydomain.com/API</code></p>

<p>We use JWT for Authentication with built-in <code>Microsoft.AspNetCore.Authentication.JwtBearer</code>; I have a controller <code>app.mydomain.com/API/auth/jwt/login</code> which creates tokens. SPA saves them into local storage. All works perfect. After a security audit, we have been told to switch local storage for cookies.</p>

<p>The problem is, that API on <code>app.mydomain.com/API</code> is used by SPA but also by a mobile app and several customers server-2-server solutions.</p>

<p>So, we have to keep JWT as is, but add Cookies. I found several articles which combines Cookies and JWT on different controllers, but I need them work side-by-side on each controller.</p>

<p>If client sends cookies, authenticate via cookies. If client sends JWT bearer, authenticate via JWT.</p>

<p>Is this achievable via built-in ASP.NET authentication or DIY middleware?</p>

<p>Thanks!</p>
