<system.web>

    <authentication mode="Forms">

      <forms name=".wechat" loginUrl="url" timeout="30" protection="All" defaultUrl="/index.html" />

    </authentication>

    <httpCookies httpOnlyCookies="true" requireSSL="true" />

  </system.web>

using Newtonsoft.Json;

using System;

using System.Security.Principal;

using System.Web;

using System.Web.Http;

using System.Web.Security;

namespace KMHC.CTMS.DrugStore.Controllers

{

    public class BaseApiController : ApiController

    {

        protected void SignIn(dynamic user)

        {

            if (user == null)

                return;

            var httpContext = HttpContext.Current;

            var version = 1;

            var name = user.OpenId;

            var now = DateTime.Now.ToLocalTime();

            var expiration = now.Add(TimeSpan.FromDays(30));

            var isPersistent = true;

            var userData = JsonConvert.SerializeObject(user);

            var ticket = new FormsAuthenticationTicket(version, name, now, expiration, isPersistent, userData, FormsAuthentication.FormsCookiePath);

            var encryptedTicket = FormsAuthentication.Encrypt(ticket);

            var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)

            {

                HttpOnly = true,

                Secure = FormsAuthentication.RequireSSL,

                Path = FormsAuthentication.FormsCookiePath

            };

            cookie.Expires = ticket.Expiration;

            if (FormsAuthentication.CookieDomain != null)

            {

                cookie.Domain = FormsAuthentication.CookieDomain;

            }

            var url = HttpContext.Current.Request.Url.ToString();

            if (!string.IsNullOrEmpty(url) && url.StartsWith("https"))

            {

                cookie.Secure = true;

            }

            httpContext.Response.Cookies.Add(cookie);

            httpContext.User = new GenericPrincipal(new FormsIdentity(ticket), new string[] { "Wechat" });

        }

        protected string OpenId

        {

            get

            {

                return this.User.Identity.Name;

            }

        }

        protected bool IsAuthenticated

        {

            get

            {

                return this.User.Identity.IsAuthenticated;

            }

        }

        protected dynamic UserInfo {

            get {

                var identity = (FormsIdentity)HttpContext.Current.User.Identity;

                var user = JsonConvert.DeserializeObject<dynamic>(identity.Ticket.UserData);

                return user;

            }

        }

    }

}

//index.html  <forms name=".wechat" loginUrl="url" timeout="30" protection="All" defaultUrl="/index.html" />

var defaultUrl= FormsAuthentication.DefaultUrl;