RestUtils.GetTokenData(AppDefaults.UrlAPI, model.User, model.Pass);

Response.SetAuthCookie(model.User, true, model);

<system.web>
    ...
    <!-- Authentication -->
    <authentication mode="Forms">
      <forms loginUrl="~/Account/Login" slidingExpiration="true" timeout="30" />
    </authentication>
    <sessionState cookieless="UseCookies" mode="InProc" timeout="30" />
</system.web>

public static class HttpResponseBaseExtensions
{
    public static int SetAuthCookie<T>(this HttpResponseBase responseBase, string name, bool rememberMe, T userData)
    {
        HttpCookie cookie = FormsAuthentication.GetAuthCookie(name, rememberMe);
        FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(cookie.Value);
        if (ticket != null)
        {
            FormsAuthenticationTicket newTicket = new FormsAuthenticationTicket(ticket.Version, ticket.Name, ticket.IssueDate, ticket.Expiration,
                ticket.IsPersistent, JsonConvert.SerializeObject(userData), ticket.CookiePath);
            string encTicket = FormsAuthentication.Encrypt(newTicket);
            cookie.Value = encTicket;
            responseBase.Cookies.Add(cookie);
            return encTicket != null ? encTicket.Length : 0;
        }
        return 0;
    }
}

public class LoginVM
{
    public string User { get; set; }
    public string Pass { get; set; }
}

public ActionResult Login(LoginVM model, string returnUrl)
{
    ViewBag.ReturnUrl = returnUrl;
    if (ModelState.IsValid)
    {
        HttpContext.Current.Session["TokenData"] = RestUtils.GetTokenData(AppDefaults.UrlAPI, AppDefaults.ProxyConfig, model.User, model.Pass);
        Response.SetAuthCookie(model.User, true, model);
        return Redirect(returnUrl);
    }
    return View(model);
}

public ActionResult LogOff()
{
    if (HttpContext.Session != null)
    {
        HttpContext.Session.Clear();
        HttpContext.Session.Abandon();
        HttpContext.Session.RemoveAll();
    }

    FormsAuthentication.SignOut();
    return RedirectToAction("Index", "Home");
}