HttpContext.User has no claims even though the cookie is set

Question

I have three websites let's say

login.example.com

dashboard.example.com

conf.example.com

in the login subdomain a cookie is set with multiple user claims, and then redirected to the dashboard where the cookie is read and the user is authenticated and i can access all the user claims, but on conf the claims are always null even though the cookie is set in the browser.

they all use the same configuration in the program.cs

var redis = ConnectionMultiplexer.Connect(builder.Configuration["Redis"]);

builder.Services.AddDataProtection()
            .SetApplicationName("example.app")
            .PersistKeysToStackExchangeRedis(redis)
            .SetDefaultKeyLifetime(TimeSpan.FromDays(14));

// Add services to the container.
builder.Services.AddControllersWithViews();

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.Cookie.Name = ".asp.cookie";
        options.Cookie.Domain = builder.Configuration["DomainName"];
        options.ExpireTimeSpan = TimeSpan.FromDays(2);
    });

builder.Services.Configure<CookiePolicyOptions>(options =>
{
    options.CheckConsentNeeded = context => false;
    options.MinimumSameSitePolicy = SameSiteMode.None;
});

builder.Services.AddHttpClient();

builder.Services.AddLocalization(options =>
{
    options.ResourcesPath = "Resource_Files";
});


var app = builder.Build();


// Configure the HTTP request pipeline.
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Home/Error");
    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseRouting();

app.UseAuthentication();
app.UseAuthorization();
app.UseCookiePolicy();

in the controller i try to get a claim of the user but it is always null in the conf.example.com

long PortalId = 0;

var portalIdclaim = User.Claims.FirstOrDefault(c => c.Type == "PortalId");

long.TryParse(portalIdclaim.Value, out PortalId);

Everything works fine on my local machine.

Not C# expert. But I had the same issieu on a Laravel project. Are the cookies encrypted and then decrypted on the application? If that's true, make sure the other applications can decrypt those cookies. You should check the value in the conf.example.com for the cookies. — Stijn Leenknegt, Jun 19 '22 at 15:43
thank you for your reply, yes they can read the encryption key it is saved in a shared redis database, i forgot to mention that it works fine on my local machine — a.tolba, Jun 19 '22 at 15:45

HttpContext.User has no claims even though the cookie is set

0 Answers0