0

I am trying to share the authentication cookie between three web applications set up under single website in IIS. The first two are both .NET Core 2.1 applications and Im struggling to even get them to share it. My problem is the same as

Sharing Cookies Between Two ASP.NET Core Applications

but I cant get it to work in my environment. I have read "Sharing cookies among apps with ASP.NET and ASP.NET Core." and downloaded the "Cookie Sharing App Sample" and got it working (as the third app is ASP.NET) and now my code in StartUp.cs looks like this in both the 2 .NET Core applications

services.AddDataProtection()
    .PersistKeysToFileSystem(new 
     DirectoryInfo(persistKeysToFileSystemDirectory))
            .SetApplicationName(applicationName);

        services.ConfigureApplicationCookie(options => {
            options.Cookie.Name = cookieName;
            options.Cookie.SameSite = SameSiteMode.Lax;
            options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
        });

If the two application solutions run under localhost on my local machine (IISEXPRESS)

http:\localhost:8174\

http:\localhost:8175\

they work fine but when I deploy to the server (IIS) the url becomes

http:\devserver1:8000\App1

http:\devserver1:8000\App2

and they do not share the authentication

If I change my local solutions to run as

http:\localhost:8174\App1

http:\localhost:8175\App2

They do not share the authentication

I didnt think that I had to set the cookie domain property as they are all under the same site however I have experimented with locally

options.Cookie.Domain = "localhost";

and on the server

options.Cookie.Domain = "devserver1";

and nothing works and sometimes it wont even let me login (invalid domain?)

Any help would be appreciated

** UPDATE **

I am getting anxious and have progressed it and have more to add.

if I set the Applications up as separate web sites with different ports on devserver1

http:\devserver1:8174\

http:\devserver1:8175\

It works and they share the authentication (also I have not had to set the options.Cookie.Domain value) - however I will not be able to refer from one to the other using the relative url anymore so App1 will not be able to go to \App2 - I will have to use the full url - but at least it works

Its not the end of the world but this seems to undermine the whole concept of Applications in IIS Websites (what the point of them?) so Im starting to wonder whether the way Im setting up IIS is the problem.

I create an empty Website and then "Add Application" for each of my applications

Currently I am just trying to get this working on the Development server (devserver1) so I dont set up Host names as such I just refer to the webserver by the machine name

This all worked fine under FormsAuthentication sharing the machine key and Im really beginning to regret I started looking at .NET Core

Any help will be greatly appreciated

ttny
  • 31
  • 5
  • You could create a domain account and run your two applications under that domain account in IIS on your server. – Ryan Wilson Aug 15 '18 at 16:34
  • Use local IIS and then use the localhost IP (127.0.0.1) for the cookie domain rather that "localhost" – Kyle Aug 15 '18 at 16:47
  • @Kyle 1 When I set options.Cookie.Domain = "127.0.0.1"; it doesn't even let me log in (doesn't write the cookie?) so I don't think that is valid – ttny Aug 15 '18 at 18:31
  • It is valid, I have many apps running this way. If you are using SSL make sure you setup at least a self signed cert for your local IIS. I had issues getting all my apps running using localhost as they include things like a custom SSO provider. – Kyle Aug 18 '18 at 05:38

2 Answers2

0

Try setting the cookie path value as below. By default it'll be restricted to App1 or App2 (my experience).

options.Cookie.Path = "/";

Check Controlling Cookie Scope.

Stang
  • 16
  • 1
0

I got it, for this I did the following:

I created one website, and add 2 applications, like you:

http:\devserver1:8000\App1, http:\devserver1:8000\App2

Then use below in StartUp:

services.AddDataProtection()
.PersistKeysToFileSystem(new 
 DirectoryInfo(persistKeysToFileSystemDirectory))
        .SetApplicationName(applicationName);

    services.ConfigureApplicationCookie(options => {
        options.Cookie.Name = cookieName;
        options.Cookie.Path = "/";// it's necessary, because by default cookie Path for App1 will be /App1, and for App2 /App2.
    });

Setting domain is not necessary, as I understood, will take domain by default

Assylzhan Shabkhatov
  • 1