✅ Can't Authenticate User

    [HttpPost]
    public IActionResult Login(LoginPoco loginPoco)
    {
        if (ModelState.IsValid)
        {
            var existingUser = _context.Logins.SingleOrDefault(u => u.Email == loginPoco.Email);

            if (existingUser != null)
            {
                if (PasswordHasher.VerifyPassword(loginPoco.Password, existingUser.Password, existingUser.Salt))
                {
                    HttpContext.Session.SetString("UserId", existingUser.Id.ToString());

                    return RedirectToAction("Index", "Home");
                }
            }

            ModelState.AddModelError(string.Empty, "Wrong email or password.");
            return BadRequest(new { success = false, message = "Wrong email or password." });
        }

        var errors = ModelState.Values.SelectMany(v => v.Errors).Select(e => e.ErrorMessage);
        return BadRequest(new { success = false, message = "Validation failed", errors });
    }

    [HttpPost]
    public IActionResult Login(LoginPoco loginPoco)
    {
        if (ModelState.IsValid)
        {
            var existingUser = _context.Logins.SingleOrDefault(u => u.Email == loginPoco.Email);

            if (existingUser != null)
            {
                if (PasswordHasher.VerifyPassword(loginPoco.Password, existingUser.Password, existingUser.Salt))
                {
                    HttpContext.Session.SetString("UserId", existingUser.Id.ToString());

                    return RedirectToAction("Index", "Home");
                }
            }

            ModelState.AddModelError(string.Empty, "Wrong email or password.");
            return BadRequest(new { success = false, message = "Wrong email or password." });
        }

        var errors = ModelState.Values.SelectMany(v => v.Errors).Select(e => e.ErrorMessage);
        return BadRequest(new { success = false, message = "Validation failed", errors });
    }

If you webapi and user interface are hosted in the same web application, token bases security does not buy you anything over the cookie based authentication provided by the built in authentication. That's because the authentication cookie gets sent back to the keep application on every HTTP request. When you make calls to a website other than the one you signed in on those cookies do not get sent. So JSON Web Tokens (JWT) provide a standard format for browser to send identity information to a website when a cookie isn't an option.

If you webapi and user interface are hosted in the same web application, token bases security does not buy you anything over the cookie based authentication provided by the built in authentication. That's because the authentication cookie gets sent back to the keep application on every HTTP request. When you make calls to a website other than the one you signed in on those cookies do not get sent. So JSON Web Tokens (JWT) provide a standard format for browser to send identity information to a website when a cookie isn't an option.