title: Share Cookie authentication between ASP.NET Core 2.2 and ASP. NET MVC 5 (.NET Framework 4.6.1) without Microsoft.Identity
body: <p>I have two application, the old one written in ASP.NET MVC5 and the new one written in ASP.NET Core 2.2. I want to share the cookie created in the ASP.NET Core application to the ASP.NET MVC5.
  I tried what is explained in this article <a href="https://docs.microsoft.com/en-us/aspnet/core/security/cookie-sharing?view=aspnetcore-2.2" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/cookie-sharing?view=aspnetcore-2.2</a> but seems that my ASP.NET MVC5 doesn’t find the cookie. (Maybe because I’m not using Microsoft.Identity for the users?)
  The cookie is created in ASP.NET Core with this configuration (Startup.cs):</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
      {
        // Cookie
        services.Configure&lt;CookiePolicyOptions&gt;(options =&gt;
        {
          // This lambda determines whether user consent for non-essential cookies is needed for a given request.
          options.CheckConsentNeeded = context =&gt; true;
          options.MinimumSameSitePolicy = SameSiteMode.None;
        }); 
  
  
  
  services.AddDataProtection()
        .PersistKeysToFileSystem(new DirectoryInfo(@"c:\temp\shared-auth-ticket-keys\"))
        .SetApplicationName(CookieConst.SHARED_APP_NAME);
  
    services
      .AddAuthentication(CookieConst.AUTHENTICATION_TYPE)
      .AddCookie(CookieConst.AUTHENTICATION_TYPE, options =&gt;
      {
        options.Cookie.HttpOnly = false;
        options.LoginPath = new PathString("/login");
        options.LogoutPath = new PathString("/login");
        options.AccessDeniedPath = new PathString("/login");
        options.Cookie.HttpOnly = false;
        options.Cookie.SameSite = SameSiteMode.None;
        options.Cookie.Name = CookieConst.AUTHENTICATION_SCHEME;
        options.Cookie.Path = "/";
        options.Cookie.Domain = "localhost";
        options.DataProtectionProvider = DataProtectionProvider.Create(
          new DirectoryInfo(@"c:\temp\shared-auth-ticket-keys\"),
          (builder) =&gt; { builder.SetApplicationName(CookieConst.SHARED_APP_NAME); }).CreateProtector(
                    "Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware",
                    CookieConst.AUTHENTICATION_TYPE,
                    "v2");
      });
  
     …
  
  }
  </code></pre>
  
  <p>The cookie is created with this code called by login:</p>
  
  <pre><code>public void Validate()
  {
    AuthenticationProperties authenticationProperties;
    ClaimsPrincipal principal;
    string cultureName;
  
    var expireTime = DateTimeHelper.GetNowDate().AddMinutes(CookieConst.EXPIRE_TIME_IN_MINUTES);
  
    authenticationProperties = new AuthenticationProperties()
    {
      AllowRefresh = true,
      IsPersistent = true,
      ExpiresUtc = expireTime
    };
  
    // Add Authentication Cookie
    var claims = new List&lt;Claim&gt;
        {
          new Claim(ClaimTypes.Name, "test"),
          new Claim(BeanClaimTypes.User, "-1"),
          new Claim(BeanClaimTypes.Company, "-1"),
          new Claim(BeanClaimTypes.Roles, "testRole"),
          new Claim(BeanClaimTypes.Permissions, "testPermission"),
          new Claim(BeanClaimTypes.Culture, "en-US")
        };
    var identity = new ClaimsIdentity(claims, CookieConst.AUTHENTICATION_TYPE);
    principal = new ClaimsPrincipal(identity);
  
    HttpContext.SignInAsync(CookieConst.AUTHENTICATION_TYPE, principal, authenticationProperties);
  }
  </code></pre>
  
  <p>In the ASP.NET MVC5 application this is the configuration (Startup.Auth.cs):</p>
  
  <pre><code>  public void ConfigureAuth(IAppBuilder app)
      {
        //// Configure the db context, user manager and signin manager to use a single instance per request
        //app.CreatePerOwinContext(ApplicationDbContext.Create);
        //app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create);
        //app.CreatePerOwinContext&lt;ApplicationSignInManager&gt;(ApplicationSignInManager.Create);  
  
      app.UseCookieAuthentication(new CookieAuthenticationOptions
      {
        AuthenticationType = CookieConst.AUTHENTICATION_TYPE,
        CookieName = CookieConst.AUTHENTICATION_SCHEME,
        LoginPath = new PathString("/Account/Login"),
        Provider = new CookieAuthenticationProvider
        {
          OnValidateIdentity = SecurityStampValidator.OnValidateIdentity&lt;ApplicationUserManager, ApplicationUser&gt;(
                        validateInterval: TimeSpan.FromMinutes(30),
                        regenerateIdentity: (manager, user) =&gt;
                            user.GenerateUserIdentityAsync(manager))
        },
        TicketDataFormat = new AspNetTicketDataFormat(
            new DataProtectorShim(
                DataProtectionProvider.Create(new DirectoryInfo(@"c:\temp\shared-auth-ticket-keys\"),
                    (builder) =&gt; { builder.SetApplicationName(CookieConst.SHARED_APP_NAME); })
                .CreateProtector(
                    "Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware",
                    CookieConst.AUTHENTICATION_TYPE,
                    "v2"))),
      CookieManager = new ChunkingCookieManager()
    });
  
    app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
  
    System.Web.Helpers.AntiForgeryConfig.UniqueClaimTypeIdentifier = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name";
  }
  </code></pre>
  
  <p>I don't understand the commented part and Provider property of CookieAuthenticationOptions, because I’m not using Microsoft.Identity and I don’t know how to read the cookie and “parse” it to have the ASP.NET MVC5 principal filled.</p>
  
  <p>What am I doing wrong?
  Thanks</p>