title: Sharing authentication between two web applications
body: <p>I have a base web site (<strong>Asp.net WebForms</strong> application) running under ie.</p>
  
  <pre><code>http://localhost:90/
  </code></pre>
  
  <p>Then I created a new (this time <strong>Asp.net MVC</strong>) application and added it under</p>
  
  <pre><code>http://localhost:90/mvc/
  </code></pre>
  
  <p>but not just as a simple virtual folder, but as an <strong>application folder</strong> by defining a different <strong>application pool</strong> to run it, compared to the <em>parent</em> application.</p>
  
  <p>Since browsers can't know that there are two different application basically on the same domain it would work like:</p>
  
  <ol>
  <li>user accesses <code>http://localhost:90/</code></li>
  <li>parent app redirects the user to forms authentication screen</li>
  <li>user successfully logs in</li>
  <li>parent web adds an authentication cookie</li>
  <li>user accesses <code>http://localhost:90/mvc</code></li>
  <li>browser attaches the same cookie from parent app</li>
  </ol>
  
  <p>Is it possible that I authenticate the user based on this same cookie? I would configure my MVC application to login redirect to parent app to have a shared authentication screen. But I'd like to know who authenticated and work from that point on.</p>
  
  <p>I've read something about sharing the same <code>system.web/machineKey</code> values to provide this kind of functionality, but I would like some real world examples.</p>
  
  <p>I'm aware that these two applications will not be able to share Session state and that's not a problem, because I don't want them to. All I want is a kind of single login (SSO/SSS)</p>
  
  <p><strong>Is this possible?</strong> How?</p>
  
  <h2>Important</h2>
  
  <p>I've read other questions/answers about this, but they are either asking about cross-domain/cross-server etc. This one is on the same IIS web site.</p>