Share Forms Authentication in ASP.NET and ASP.NET Core applications

Question

I have one ASP.NET application "A" that has forms authentication and has exposed WebAPI. Now I need to create another ASP.NET Core application "B" which would internally call application "A" by creating a cookie by itself (for some specific hardcoded user) and call WebAPI methods of application "A" properly, as if user logged in.

Answer 1

Sharing forms authentication between an ASP.NET and ASP.NET Core is possible if the two sites are on the same domain or sub-domain. Scott Hanselman has a post on this at https://www.hanselman.com/blog/SharingAuthorizationCookiesBetweenASPNET4xAndASPNETCore10.aspx . Here are the basic steps:

1. Install the interop packages into your applications
   • ASP.NET 4.5: add the Microsoft.Owin.Security.Interop NuGet package
   • ASP.NET Core: add the Microsoft.AspNetCore.DataProtection.Extensions NuGet package
2. Set the CookieName in each application so they are the same
3. Set the CookieDomain property if your applications are using sub-domains
4. Configure each application to use same the AspNetTicketDataFormat cookie format