title: ASP .NET Core cookie authentication
body: <p>I have an ASP.NET Web API site that is using an authentication cookie generated from another ASP.NET Web Form site.<br>
  Since both the ASP.NET Web API site and the ASP.NET Web Form site have the same "machineKey" and same "form auth cookie name", it would allow a user to login to the "Web Form Site" and then pull data from the "Web API Site" without re-authentication since the "auth" cookie would pass between sites.<br>
  All this was done inside that web.config and did not require any special code to work.   </p>
  
  <p>Now we would like to create an ASP NET Core Web API site and have that same auth cookie work.  </p>
  
  <p>I can't seem to find any good articles on how do this in .NET Core.<br>
  There are plenty of articles on how to us ASP Identity which we don't have and plenty of articles on auth cookies but none explaining how to get it from another site...  </p>
  
  <p>Here is the web.config sections that I had in the Web API:  </p>
  
  <pre><code>  &lt;system.web&gt;
      &lt;authentication&gt;
        &lt;forms name=".TESTAUTH" cookieless="AutoDetect" requireSSL="true" domain=".test.com" slidingExpiration="true" protection="All" timeout="600"
               enableCrossAppRedirects="true" /&gt;
      &lt;/authentication&gt;
  
      &lt;!-- This is used to share the auth cookie between web sites --&gt;
      &lt;machineKey validationKey="SOMEKEY"
                  decryptionKey="SOMEOTHERKEY" validation="SHA1" decryption="AES" compatibilityMode="Framework20SP2" /&gt;
    &lt;/system.web&gt;
  </code></pre>
  
  <p><strong>EDIT A</strong><br>
  We are using "Framework20SP2" and that seems to complicate the issue.<br>
  Here is a link to some code that will decrypt the auth ticket based on "Framework20SP2"<br>
  <a href="https://github.com/dazinator/AspNetCore.LegacyAuthCookieCompat" rel="nofollow noreferrer">https://github.com/dazinator/AspNetCore.LegacyAuthCookieCompat</a>  </p>
  
  <p>If I use the NuGet above, it does decrypt the auth cookie in the .NET Core site but I can't seem to figure out how to get that to work in the .NET Core DataProtectionProvider.  </p>