How to share encrypted cookies between asp.net 4.5 and asp.net core?

Question

We have few asp.net 4.5 applications that share authentication cookies (SSO) secured by a web config machinekey and I wont change them.

ASP.NET 4.5 sign in:

    var auth = FederatedAuthentication.SessionAuthenticationModule;
 auth.WriteSessionTokenToCookie(new System.IdentityModel.Tokens.SessionSecurityToken(cp));

Now we are about to implement new asp.net core application in the same domain and we want to keep old cookies authorization mechanism. Federatedauthentification is failing on a runtime for a CORE, any clues is it possible to decrypt our old cookies from the same domain and share new one with asp.net and asp.net core?

ASP.NET core setup:

    public void ConfigureServices(IServiceCollection services)
    {
        services.Configure<CookiePolicyOptions>(options =>
        {
            options.CheckConsentNeeded = context => true;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        });

        services.AddMvc()
            .AddRazorPagesOptions(options =>
            {
                options.Conventions.AuthorizePage("/Contact");
            })
            .SetCompatibilityVersion(CompatibilityVersion.Version_2_1);

        #region snippet1
        services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
            .AddCookie();
        #endregion

        services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
            app.UseDatabaseErrorPage();
        }
        else
        {
            app.UseExceptionHandler("/Error");
            app.UseHsts();
        }

        app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseCookiePolicy();

        // Call UseAuthentication before calling UseMVC.
        #region snippet2
        app.UseAuthentication();
        #endregion

        app.UseMvc();
    }

Asp.NET core cookies sign in:

var claims = new List<Claim>
                {
                    new Claim(ClaimTypes.Name, user.Email),
                    new Claim("FullName", user.FullName),
                    new Claim(ClaimTypes.Role, "Administrator"),
                };

                var claimsIdentity = new ClaimsIdentity(
                    claims, CookieAuthenticationDefaults.AuthenticationScheme);

                var authProperties = new AuthenticationProperties
                {
                    //AllowRefresh = <bool>,
                    // Refreshing the authentication session should be allowed.

                    //ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(10),
                    // The time at which the authentication ticket expires. A 
                    // value set here overrides the ExpireTimeSpan option of 
                    // CookieAuthenticationOptions set with AddCookie.

                    //IsPersistent = true,
                    // Whether the authentication session is persisted across 
                    // multiple requests. Required when setting the 
                    // ExpireTimeSpan option of CookieAuthenticationOptions 
                    // set with AddCookie. Also required when setting 
                    // ExpiresUtc.

                    //IssuedUtc = <DateTimeOffset>,
                    // The time at which the authentication ticket was issued.

                    //RedirectUri = <string>
                    // The full path or absolute URI to be used as an http 
                    // redirect response value.
                };

                await HttpContext.SignInAsync(
                    CookieAuthenticationDefaults.AuthenticationScheme, 
                    new ClaimsPrincipal(claimsIdentity), 
                    authProperties);

Endothelium

This is clearly documented: learn.microsoft.com/en-us/aspnet/core/security/…. There's a number of prerequisites that must be in place, but if you can implement all that, you're good to go. – Jejunum

@Chris Pratt they have created new .NET framework application and they share the same key. I dont want to change my existing applications. Existing application uses machinekey instead. I am not sure whether it's possible to convert existing machine key and what kind of algorithm is used by a default to keep same cookies encrypt-decrypt flow. – Endothelium

You have to change your project. Period. The only way you can share cookies is if they're all using data protection provider instead of machine key. There is no workaround or alternate solution. Follow the docs, or give it up. – Jejunum