title: Why is User.Identity.IsAuthenticated == false when called via CORS
body: <p>Why is User.Identity.IsAuthenticated == false when called via CORS, but true when called via same domain?  </p>
  
  <p>I have a working asp.net core 2 cookieauth app that is CORS enabled.  </p>
  
  <p>When I call; </p>
  
  <blockquote>
    <p>api/Identity/establish-session  </p>
  </blockquote>
  
  <p>an AUTHCOOKIE gets dropped in both<br>
  CORS and local ajax calls.<br>
  Conversely when I call </p>
  
  <blockquote>
    <p>api/Identity/sign-out  </p>
  </blockquote>
  
  <p>The AUTHCOOKIE gets removed.  All good so far.</p>
  
  <p>After a successful establish-session, when I call the following;   </p>
  
  <blockquote>
    <p>api/Identity/check-authentication  </p>
  </blockquote>
  
  <p>User.Identity.IsAuthenticated == false when called via CORS, but User.Identity.IsAuthenticated == true when called from the same domain.<br>
  I don't know if this is because of how I call it in javascript or if I have something configured wrong on the asp.net app.  I thought I just had to have credentials: 'include' set in my fetch call?  </p>
  
  <pre><code>[Produces("application/json")]
  [Route("api/Identity")]
  public class IdentityController : Controller
  {
      [HttpPost]
      [AllowAnonymous]
      [Route("establish-session")]
      public async Task EstablishAuthenticatedSession(string username, string password)
      {
  
          var properties = new AuthenticationProperties
          {
              IsPersistent = true,
              ExpiresUtc = DateTime.UtcNow.AddHours(1)
          };
  
          var claims = new[] {new Claim("name", username), new Claim(ClaimTypes.Role, "User")};
          var identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
          await
              HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme,
                  new ClaimsPrincipal(identity),
                  properties);
      }
  
      [HttpGet]
      [AllowAnonymous]
      [Route("sign-out")]
      public async Task Logout()
      {
          await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
      }
      [HttpGet]
      [AllowAnonymous]
      [Route("check-authentication")]
      public async Task&lt;bool&gt; CheckAuthentication()
      {
          return User.Identity.IsAuthenticated;
      }
  }
  </code></pre>
  
  <p>Here is my javascript snippets;  </p>
  
  <pre><code>establishAuthenticatedSession(){
  
              let self = this;
              var model = this.get();
              console.log(model);
              var url = "https://localhost:44310/api/Identity/establish-session?username=herb&amp;password=1234";
              fetch(url,
              {
                  credentials: 'include',
                  headers: { 'Content-Type': 'text/plain' },
                  method: 'POST'
              })
              .then(function (res) {
                  console.log(res);
                  self.set({ establishSession:{ message:"Success" }});
              }).catch(function(error) {
                  self.set({ establishSession:{ message:error.message }});
                  console.log('There has been a problem with your fetch operation: ' + error.message);
              });
  
          },
          signOut(){
  
              let self = this;
              var model = this.get();
              console.log(model);
              var url = "https://localhost:44310/api/Identity/sign-out";
              fetch(url,
              {
                  credentials: 'include',
                  headers: { 'Content-Type': 'text/plain' },
                  method: 'GET'
              })
              .then(function (res) {
                  console.log(res);
                  self.set({ signoutResult:{ message:"Success" }});
              }).catch(function(error) {
                  self.set({ signoutResult:{ message:error.message }});
                  console.log('There has been a problem with your fetch operation: ' + error.message);
              });
  
          },
          checkAuthenticatedSession(){
              let self = this;
              var model = this.get();
              console.log(model);
              var url = "https://localhost:44310/api/Identity/check-authentication";
              fetch(url,
              {
                  credentials: 'include',
                  method: 'GET',
                  headers: { 'Content-Type': 'text/plain' }
              })
              .then(res =&gt; res.text())
              .then(function (res) {
                  console.log(res);
                  self.set({ checkAuthenticatedSession:{ message:res }});
              })
              .catch(function(error) {
                  self.set({ checkAuthenticatedSession:{ message:error.message }});
                  console.log('There has been a problem with your fetch operation: ' + error.message);
              });
          }
  </code></pre>
  
  <p>This is my CORS setup;  </p>
  
  <pre><code>services.AddCors(options =&gt;
              {
                  options.AddPolicy("CorsPolicy",
                      builder =&gt; builder
                          .AllowAnyOrigin()
                          .AllowAnyMethod()
                          .AllowAnyHeader()
                          .AllowCredentials());
              });
  </code></pre>