sample

AccountController.cs

    [InitializeSimpleMembership]
    public class AccountController : ApiController
    {

        public object LogUser(MyLoginModel user)
        {
            
            if (ModelState.IsValid && Membership.ValidateUser(user.Login, user.Password))
            {
                // set authentication cookie
                FormsAuthentication.SetAuthCookie(user.Login, true);
                return new { success = true };
                            
            }
            else
            {
                return new { success = false, message = "Le nom d'utilisateur ou mot de passe fourni est incorrect." };
            }

        }
    }

externalClient.js

//ajax request to log user accountControllerAPI
           $.ajax({
                    type: "POST",
                    url: urlApi+"Account/LogUser",
                    data: self.userLog,
                    error: function (msg) {
                        console.log(msg);
                        alert("Error !: " + msg);
                    },
                    success: function (data) {
                       console.log(data)
                    }
                });
//ajax request to Authorize action 
            $.ajax({
                    type: "POST",
                     url: urlApi+"Rank",
                    dataType: "json",
                    data:{IdMatch:4},
                    error: function (msg) {
  					            console.log("retour error");
                        console.log(msg);
                        if(msg.status == '401')
						            {
							            $("#formAuth").dialog({
                                width:1000,
                                title:'Login !'
                            });
						            }
                    },
                    success: function (p) {
                        //affiche le contenu du fichier dans le conteneur dédié
                        console.log("callbacl success post");
                        console.log(p);
                    }
                });

global.asax

 protected void Application_Start()
        {
            AreaRegistration.RegisterAllAreas();
            FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);                         

            RankOl.Common.Security.WebApiConfig.Register(GlobalConfiguration.Configuration);

            RouteConfig.RegisterRoutes(RouteTable.Routes);
            BundleConfig.RegisterBundles(BundleTable.Bundles);
            AuthConfig.RegisterAuth();     
        }
 // claims transformation
        protected void Application_PostAuthenticateRequest()
        {
            if (ClaimsPrincipal.Current.Identity.IsAuthenticated)
            {
                var principal = new ClaimsTransformer().Authenticate(string.Empty, ClaimsPrincipal.Current);

                HttpContext.Current.User = principal;
                Thread.CurrentPrincipal = principal;
            }
        }

WebApiConfig.cs

    public static class WebApiConfig
    {
        public static void Register(HttpConfiguration config)
        {
            CorsConfiguration corsConfig = new CorsConfiguration();
            corsConfig.AllowAll();
            var corsHandler = new CorsMessageHandler(corsConfig, config);
            config.MessageHandlers.Add(corsHandler);

            // authentication configuration for identity controller
            var authentication = CreateAuthenticationConfiguration();
            config.MessageHandlers.Add(new AuthenticationHandler(authentication));

            // default API route
            config.Routes.MapHttpRoute(
                name: "DefaultApi",
                routeTemplate: "api/{controller}/{id}",
                defaults: new { id = RouteParameter.Optional }
            );
        }

        private static AuthenticationConfiguration CreateAuthenticationConfiguration()
        {
            var authentication = new AuthenticationConfiguration
            {
                ClaimsAuthenticationManager = new ClaimsTransformer(),
                SendWwwAuthenticateResponseHeaders = true,                
                InheritHostClientIdentity = true,
                EnableSessionToken = false,
                RequireSsl = false
                


            };

            #region Basic Authentication
            authentication.AddBasicAuthentication((username, password)
                => Membership.ValidateUser(username, password));//UserCredentials.Validate(username, password));
            #endregion
                return authentication;
        }
    }

I think I must send the cookie in the header request ?