DataProtector | protect data | Architecture library

As per these documents, each Encrypt call generates a separate key and a random initialization vector (IV) at least with the default settings i.e AES-256-CBC for payload protection and HMACSHA256 for authenticity. For this reason, we can't generate the same cipherText corresponding to a given plainText.

For anyone who sees this - I was able to solve this issue. I removed these lines and replaced services.AddIdentity() .AddEntityFrameworkStores();

with the following:

services.AddIdentityCore().AddRoles().AddSignInManager() .AddEntityFrameworkStores();

I removed my own identity user to eliminate any issues if any were because of the user and used the AddIdentityCore method rather than AddIdentity . This stopped the error I kept getting stating the the "Scheme already exists: Identity.Application" because of this line .AddCookie("Identity.Application".

Also i added the app name to both applications: .net 4x ,(builder) => { builder.SetApplicationName("cms-app"); }) and in the .net core app .PersistKeysToFileSystem(new DirectoryInfo(@"c:\temp\keyring")) .SetApplicationName("cms-app");

It may happen if something else injects that same class later (for example, AddIdentity).

I cannot reproduce the problem you are describing and do not have the same classes in my Identity package (I guess you are using an extended one?), so I have to create my own:

It's worth noting that you don't need to gain access to the keys to decrypt the authentication cookie. You simply need to use the right IDataProtector created with the right purpose parameter, and subpurpose parameters.

Based on the CookieAuthenticationMiddleware source code https://github.com/aspnet/Security/blob/rel/1.1.1/src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationMiddleware.cs#L4 it looks like the purpose you need to pass is typeof(CookieAuthenticationMiddleware). And since they are passing additional parameters to the IDataProtector you will need to match them. So this line of code should get you an IDataProtector that can be used to decrypt the authentication cookie:

Edit following the comments below

The .AspNet.Cookies is the authentication cookie that allows the server to know when a user is logged in to your application.

The fact that you use Redis doesn't mean there's no need for a cookie anymore. How could you differentiate users A and B if they didn't send cookies?

If you were not using Redis, the authentication cookie value would contain the user information. When using Redis, the user information is stored there, and the authentication cookie value contains the Redis key that allows to access this information.

A session cookie is different from an athentication cookie in the sense that a user doesn't need to be logged in for you to store session data for them. This could be useful for, let's say, an ecommerce application where you show both unlogged and logged users which products they have looked at.

The same concept could apply to session: instead of storing that data in the cookie, you could decide to use an external store so that the amount of data that travels between the browser ad the server is minimal (only the session key).

Original answer

A cookie is still needed to identify the user.

The difference is that the cookie now no longer contains the session data, but only the Redis key that allows to access the session data.

So after @Tseng helped me a lot with his input, here is my result (more input on how to do it better would be nice):

1. Added the un-protector for the token as a service with adding in Startup.cs

I honestly am not familiar with DDAPI. A generic answer though since it's a generic question...

A string is just a piece of data. It's impossible to know if it's junk (encrypted) or not (decrypted) without knowing what to look for, that is, some kind of context or indicator you always know to look for. I would suggest that you encrypt your data (your string), then sign it. In 'isprotected', try to verify the signature. If it verifies you'll know you need to decrypt it and it's from a trustworthy source.

https://blogs.msdn.microsoft.com/alejacma/2008/06/25/how-to-sign-and-verify-the-signature-with-net-and-a-certificate-c/

You need to override

The identity cookie doesn't have a domain set. You don't need to add Cookie a second time, because Identity already adds it, and you need to configure that instance, not the new one you're creating

So try using ConfigureApplicationCookie