How to modify .Aspnetcore.Identity.Application Cookie name?

Question

How to modify .Aspnetcore.Identity.Application Cookie name?

Zang-Ho Bae 26

I wanna hide that i use ASP.NET Core.

How to do this?

Accepted answer

2 additional answers

Your answer

Answer 1

Michael Taylor 60,161

Can you not just set the cookie name as part of your AddAuthentication call?

csharp
services.AddAuthentication()
            .AddCookie(options => {
   options.CookieName = "MyAuth.Cookie"
});

Zang-Ho Bae 26 Reputation points

2021-01-06T16:14:50.067+00:00

This method didn't worked in my project.

I'm working on dotnet core version 5.0.1 environment.

You are code is maybe work on dotnet core version 2.x.

Zang-Ho Bae 26

I solved this problem.
This is my code.

.
.
.
using Microsoft.Extensions.DependencyInjection;
.
.
.
namespace MyProject
{
    public class Startup
    {
        .
        .
        .
        public void ConfigureServices(IServiceCollection services)
        {
            .
            .
            .
            services.ConfigureApplicationCookie(options =>
            {
                options.Cookie.Name = "MyCustomCookieName";
            });
            .
            .
            .
        }
        .
        .
        .
    }
}

Answer 2

hasan hüseyin topal 5

I dont know why but you cant rename cookie name with AddCookie(options...) you have to do

builder.Services.ConfigureApplicationCookie(opt =>{
opt.Cookie.Name = "YourCookieName";
});

Answer 3

Michael Taylor 60,161

.NET 5 is just .NET Core 4 renamed to avoid confusion. What is the cookie name you're seeing?

Zang-Ho Bae 26 Reputation points

2021-01-06T16:26:17.003+00:00

This is The DevTool Window that my seeing in Chrome.
Michael Taylor 60,161 Reputation points

2021-01-06T16:53:09.757+00:00

It is working fine for me. Changing the Cookie.Name property correctly replaces AspNetCore.Identity.Application. But there could be a couple of things going on here so you should verify. Firstly if you have any sort of persistence option in the browser then the cookie will persist across sessions. Therefore if you had used the original cookie name, changed the name in code and then reran the app then you'd see both the old and new cookie. Clear your cookies for the site after changing the name and then log back into the site. The default cookie name should be gone.

I will say that changing the cookie name will not hide that you're using ASP.NET Core. There are other (unchangeable) cookies that indicate Core. From a security standpoint it does make sense to limit server info but it probably isn't going to change an attackers approach that much. I would only change the cookie for SSO purposes myself.
Zang-Ho Bae 26 Reputation points

2021-01-06T17:30:15.517+00:00

Thanks to your answer cooldadtx.
I cleared cookies. But, The cookie what had new name was didn't generated.
Ok, I will try it one more time as you said.

And, As far as I know, ASP.NET Core has default one cookie and has one more cookie, if i used the identity.
I modified the default cookie name already and cookie of identity in a few ago too.

The why i used individual authentication is which my project is inner system on my company.

I learned another way thanks to your hard.

Thank you cooldadtx.
Michael Taylor 60,161 Reputation points

2021-01-06T17:39:57.183+00:00
ASP.NET Core has more than one cookie. If you're building an MVC app then the anti forgery cookie is named with aspnetcore. Other components will do this as well. You can see this by creating a new ASP.NET Core 5 app with user auth and MVC. I'm seeing 3 aspnet cookies just by logging in. For reference here's the auto-generated startup code with the cookie name change and what I see in the browser.

csharp //After services.AddDefaultIdentity()... services.ConfigureApplicationCookie(options => options.Cookie.Name = "TestApp");

Share via

How to modify .Aspnetcore.Identity.Application Cookie name?

2 additional answers

Your answer