asp.net - Is it possible to use OAuth2 to secure "non-rest" applications -

we have application written in asp.net mvc consists of web (non rest, using razor) , api projects (and other projects, besides point now).

authentication in web done using basic forms authentication , authentication in api done using oauth2.

having 2 ways of authentication in same application has proven difficult maintain, decided discard forms authentication , use oauth2 both web , api projects.

in web project, have store oauth2 tokens in cookies instead of sending them headers. possible use oauth2 secure "non-rest" applications ? if so, there security concerns in doing so?

there excellent articles on topics interested. these articles explain details looking for.

1. tokens , cookies.
2. the ultimate guide mobile api security
3. the common oauth2 vulnerability
4. using oauth 2.0 soap api
5. using oauth2 soap
6. asp.net webforms oauth2 multi-tenant resource , wpf client

these sites starting point. oauth 2.0 criticized lot security vulnerabilities pointing out common in other authentication model. if vulnerabilities addressed in application security issues mitigate itself.

1. oauth 2.0 threat model , security considerations
2. common oauth2 vulnerabilities , mitigation techniques
3. saferweb: oauth2.a or let's fix it

but must noted oauth2 not next generation of oauth1. can find excellent article here.