How to authenticate on an ASP.NET 4.0 application and Redirect to ASP.NET 3.5 app
<p>On a Windows Server 2003 machine running IIS 6 I have an ASP.NET 4.0 web application on its own website (<strong>http://authorize.com</strong>) that has the Login.aspx page.  When the login button is pressed it authenticates the user with:</p>

<pre><code>FormsAuthentication.SetAuthCookie("spud", False)        
Response.Redirect("http://legacy.com/Default.aspx")
</code></pre>

<p>In the web.config of <strong>authorize.com</strong> I have the authentication configured like so:</p>

<pre><code>&lt;authentication mode="Forms"&gt;
      &lt;forms loginUrl="Login.aspx"
             timeout="5000000"
             ticketCompatibilityMode="Framework20"
             protection="Validation"&gt;
&lt;/authentication&gt;
&lt;authorization&gt;
   &lt;deny users="?"/&gt;
&lt;/authorization&gt;
&lt;machineKey decryptionKey="AF96F355CEC57EFD2F996515BF465166075E596F19EB9B47"
   validationKey="5C9D7A8F3E336278F771C7FE45B65BF6E9B41BA9575F04672CCC4242B225DD399FAF7B806B2CD5545200CD0E63A8991CA6BFB2D77FE9C5B0D69889359574C5F3" 
   validation="SHA1" 
   decryption="3DES"/&gt;
</code></pre>

<p>I also have an ASP.NET 3.5 web application on a different website (<strong>http://legacy.com</strong>).
It has a web.config of:

    


    
<br>
</p>

<p>What is currently happening is when you go to <strong>http://legacy.com/Default.aspx</strong> it redirects you to <strong>http://authorize.com/Login.aspx</strong> and then when you click the login button it takes you back to the Login.aspx page as if you were not authenticated.</p>

<p>How do I configure my sites so that the ASP.NET 3.5 site can share the authentication token of the ASP.NET 4.0 site? </p>

<p><strong>EDIT</strong>: I had to explicitly add protection="Validation" in the forms tag of all web.config's to make the ASPXAUTH cookie the same length.</p>
