Can System.Web be used with ASP.Net Core with Full Framework

Question

We are running serveral sites based on different .Net versions.

One of the sites is running .Net 4.6 and ASP.Net MVC 5.xx

To use the new syntax for Razor we want to upgrade this site to use .Net 4.6 and ASP.Net Core

We use FormsAuthentication on our sites, and we will continue using that so user can move between sites. (one of the sites is a SharePoint site running FormsAuthentication)

We understand that ASP.Net Core is not using anything from System.Web but we need to use that from controllers (to create FormsAuthentication cookie during login) and from HttpModule to verify cookie.

I have not been able to find any example how to use system.web from a site running ASP.Net Core with Full framwork. I have not been able to add dependency for system.web in project.json.

Questions.

1. Is it possible to use system.web from a setup like this?

2. How can we add dependency to system.web so System.Web.FormsAuthentication is available from ASP.NET MVC 6. (Controllers/ http module)

Solution 1

Using the System.Web dll isn't the same as using System.Web. None of the System.Web pipeline will run for your ASP.NET Core application so you can't do what you are trying to do.

Solution 2

That may not work the way you think. When you use .Net Core MVC against the full framework it's true that the System.Web namespace exists and could technically be called but it won't work like you want. The reason is that the request pipeline for Asp.Net Core and System.Web are totally different. So for example when using Asp.Net Core MVC if you check the HttpContext object from when a request comes in it will be populated with all the information you expect but if you check for the current request using System.Web objects you will see that their is no current request. That's because the current request didn't come in via the System.Web pipeline. It came in through the .Net Core "pipeline" if you will. So if you are using .Net Core MVC you will need to stick with the tools and approaches of that framework, not the ones provided in System.Web.

However, It should be possible to reference the System.Web.dll if your really want to. If you are using VS2015 you will need to get a copy of the System.Web.Dll and wrap it in a nuget package in order to establish a reference to it. See here .net core 1.0 visual studio referencing external dll VS2017RC has alpha tooling that should eliminate the need to wrap it in a NuGet package but I've had trouble installing it on my machine so I can't vouch for it personally. Update: VS2017 now has great tooling for Asp.Net Core and referencing full framework Dlls.

Comments

[DavidG]

Why not just do forms authentication in .Net core?

[TheTechArch]

Forms authentication is not supported in .Net Core. That is one of the reasons we cant move to .Net Core since we are running all this other sites with FormsAuthentication. (there are also other dependencies that are not compatible with .Net core at current time)

[davidfowl]

Using the System.Web dll isn't the same as using System.Web. None of the System.Web pipeline will run for your ASP.NET Core application so you can't do what you are trying to do.

[Dejan Janjušević]

It should be possible to make the FormsAuthentication work with Asp.Net Core, see here for an example: stackoverflow.com/questions/44018218/…

[TheTechArch]

We are explicit sending the Cookies to FormsAuthentication so that is not really a problem. (if not FormsAuthenticaiton inside expect somthing from request) Example from HttpModule verifying cookie FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(cookie.Value)

[RonC]

I hear ya, and if you can work with low enough primitive methods in the FormsAuthentication API from 4.x that don't access the HttpContext or any of it's subobjects then you might be able to get it to work. But that's a big if, and not one most people would want to support in production.

[TheTechArch]

We at least want to try to see if is possible. I really like the new clean Razor syntax. (we are building other non related sites with .Net core) But first we need a way to create a dependencey for system.web that is accessible from application running full framework. If even that is not possible it is a showstopper for FormsAuthentication and we then maybe need to look into changig the authentication for the rest of the sites to something new that can be used across.

[TheTechArch]

Thanks David. That what I was afraid of. I would need to start looking in to the option on how to replace formsauthentication in SharePoint with something compatible then.

[JoshYates1980]

A lot of the System.Web similarities are within Microsoft.AspNetCore.

[Margo Noreen]

@TheTechArch Any chance you could share any information, tips, references, anything at all, that you came up with to "share" authentication between a webforms and razor pages/.net core site?

[TheTechArch]

@MargoNoreen we ended up with create a custom mechanismen where the asp.net core app call the legacy platform to decrypt the aspxauth and convert it to a JWT.

[Karthic G]

Can we add Microsoft.AspNetCore instead of System.Web ?