I'm trying to use an authentication cookie that was generated in .NET 4.6.1 and use it in a .NET Core application. I found several articles that all give the same suggestion on how to do it:
The code looks like this:
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType = "Identity.Application",
CookieName = ".AspNet.SharedCookie",
LoginPath = new PathString("/Account/Login"),
Provider = new CookieAuthenticationProvider
{
OnValidateIdentity =
SecurityStampValidator
.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
validateInterval: TimeSpan.FromMinutes(30),
regenerateIdentity: (manager, user) =>
user.GenerateUserIdentityAsync(manager))
},
TicketDataFormat = new AspNetTicketDataFormat(
new DataProtectorShim(
DataProtectionProvider.Create(GetKeyRingDirInfo(),
(builder) => { builder.SetApplicationName("SharedCookieApp"); })
.CreateProtector(
"Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware",
"Identity.Application",
"v2"))),
CookieManager = new ChunkingCookieManager()
});
The TicketDataFormat section in the options is what encrypts the cookie.
The problem is that the original cookie that's generated in 4.6.1 used to be about 4kb, but when I encrypt the cookie using the process described in the article the cookie balloons in size to about 58kb across 15 chunked cookies. This causes the site to send a 400 error because the response header is too large. I couldn't find a way to get these cookies any smaller.
Has anyone experienced this? How did you get around it?
Thank you.