Authentication of forms through virtual directories

Question

I am trying to pass auth forms from the root application to a routine running in a virtual directory. I am having problems authenticating with a sub site.

In the parent application, everything works as expected.

I have the following setup:

Parent application:

• URL : http://localhost:1336/
• <forms loginUrl="~/account/sign-in" protection="All" timeout="30" name=".MYAPPLICATION" path="/" requireSSL="false" slidingExpiration="true" cookieless="UseDeviceProfile" enableCrossAppRedirects="true" defaultUrl="/" />

Virtual directory:

• URL : http://localhost:1336/subsite
• <forms loginUrl="/account/sign-in" protection="All" timeout="30" name=".MYAPPLICATION" path="/" requireSSL="false" slidingExpiration="true" cookieless="UseDeviceProfile" enableCrossAppRedirects="true" defaultUrl="/" />

When I try to execute http://localhost:1336/subsite , I get the following stream:

• GET for http://localhost:1336/subsite → 302 to / account / sign-in? ReturnUrl =% 2fsubsite (looks normal)
• Enter username / password
• POST to http://localhost:1336/account/sign-in?ReturnUrl=%2fsubsite → 302 / subsite (great, auth looks like successful)
• GET for http://localhost:1336/subsite → 302 to / account / sign-in? ReturnUrl =% 2fsubsite (IE, the child node does not consider it authenticated)

I can also see the cookie in the list in my browser (so it’s actually there)

What I got wrong in my configuration that stops my child node from sharing the parent cookie?

I am running this on IISExpress

Answer 1

In your web.config files, set a shared machine key between projects, so that 2 domains share the keys of decryption and decryption.

Example:

 <machineKey validationKey="21F090935F6E49C2C797F69BBAAD8402ABD2EE0B667A8B44EA7DD4374267A75D7" decryptionKey="ABAA84D7EC4BB56D75D217CECFFB9628809BDB8BF91CFCD64568A145BE59719F" validation="SHA1" decryption="AES" />