title: .NET Core 2.2 sends out authentication cookie but doesn't recognise it
body: <p>I'm using .NET Core 2.2 Web API with an Angular 8 SPA. The Angular bit is unimportant to the question, but the important bit to note is that <strong>I'm not using MVC</strong>.</p>
  
  <p>I'm also using EntityFramework Identity to authenticate users with Cookies.</p>
  
  <p>For my testing, I'm using <a href="https://insomnia.rest/" rel="nofollow noreferrer">Insomnia</a>.</p>
  
  <p>My endpoint to log in works, and produces a cookie, which is stored by Insomnia and resent on future requests.</p>
  
  <p>My issues start here. I currently cannot get the application to recognise the cookie and my API responds with <code>401 Unauthorized</code> to any endpoints marked with the <code>[Authorize]</code> attribute despite having a valid cookie which has a life of 7 days.</p>
  
  <p>Here's my <code>Startup.cs</code> file:</p>
  
  <pre class="lang-cs prettyprint-override"><code>    public void ConfigureServices(IServiceCollection services)
      {
  
          services.AddSwaggerGen(x =&gt;
          {
              // stuff
          });
  
          services.AddDbContext&lt;SensoLicensingContext&gt;(options =&gt; {
              // stuff
          });
  
          services.AddIdentity&lt;ApplicationUser, IdentityRole&gt;()
              .AddEntityFrameworkStores&lt;LicencingContext&gt;()
              .AddDefaultTokenProviders();
  
          services.ConfigureApplicationCookie(options =&gt;
          {
              options.Events.OnRedirectToLogin = context =&gt;
              {
                  context.Response.Headers["Location"] = context.RedirectUri;
                  context.Response.StatusCode = 401;
                  return Task.CompletedTask;
              };
          });
  
          services.AddTransient&lt;IEmailSender, EmailSender&gt;();
          services.Configure&lt;AuthMessageSenderOptions&gt;(options =&gt;
              Configuration.GetSection("SendGridEmailSettings").Bind(options));
  
          services
              .AddMvcCore()
              .AddApiExplorer()
              .AddAuthorization()
              .AddFormatterMappings()
              .AddJsonFormatters()
              .AddCors()
              .SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
  
          services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
              .AddCookie();
  
              // In production, the Angular files will be served from this directory
          services.AddSpaStaticFiles(configuration =&gt;
          {
              configuration.RootPath = "ClientApp/dist";
          });
      }
  
      public void Configure(IApplicationBuilder app, 
                  IHostingEnvironment env, 
                  UserManager&lt;ApplicationUser&gt; userManager,
                  RoleManager&lt;IdentityRole&gt; roleManager,
                  LicensingContext dbContext)
      {
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
              app.UseSwagger();
              app.UseSwaggerUI(x =&gt;
              {
                  x.SwaggerEndpoint(Constants.SwaggerEndPointUrl, Constants.SwaggerEndPointName);
              });
          }
          else
          {
              app.UseExceptionHandler("/Error");
              // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
              app.UseHsts();
              app.UseHttpsRedirection();
          }
  
          app.UseStaticFiles();
          app.UseSpaStaticFiles();
          app.UseAuthentication();
  
          dbContext.Database.EnsureCreated();
          IdentityDataInitializer.SeedData(userManager, roleManager);
  
          app.UseMvc(routes =&gt;
          {
              routes.MapRoute(
                  name: "default",
                  template: "{controller}/{action=Index}/{id?}");
          });
  
          app.UseSpa(spa =&gt;
          {
              // To learn more about options for serving an Angular SPA from ASP.NET Core,
              // see https://go.microsoft.com/fwlink/?linkid=864501
  
              spa.Options.SourcePath = "ClientApp";
  
              if (env.IsDevelopment())
              {
                  spa.UseAngularCliServer(npmScript: "start");
              }
          });
      }
  </code></pre>
  
  <p>I have a feeling the issue lies in this part, either my ordering or it's in the wrong place entirely, but I'm relatively new to .NET Core so I'm not sure:</p>
  
  <pre class="lang-cs prettyprint-override"><code>services
      .AddMvcCore()
      .AddApiExplorer()
      .AddAuthorization()
      .AddFormatterMappings()
      .AddJsonFormatters()
      .AddCors()
      .SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
  
  services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
      .AddCookie();
  </code></pre>
  
  <p>Any help would be kindly appreciated.</p>