app.UseCookieAuthentication(new CookieAuthenticationOptions()
 {
  AuthenticationScheme = "MyCookieMiddlewareInstance",
  LoginPath = new PathString("/Account/Unauthorized/"),
  AccessDeniedPath = new PathString("/Account/Forbidden/"),
  AutomaticAuthenticate = true,
  AutomaticChallenge = true
 });

Task ValidateAsync(CookieValidatePrincipalContext context);

public static class LastChangedValidator
 {
  public static async Task ValidateAsync(CookieValidatePrincipalContext context)
  {
   // Pull database from registered DI services.
   var userRepository = context.HttpContext.RequestServices.GetRequiredService<IUserRepository>();
   var userPrincipal = context.Principal;

   // Look for the last changed claim.
   string lastChanged;
   lastChanged = (from c in userPrincipal.Claims
       where c.Type == "LastUpdated"
       select c.Value).FirstOrDefault();

   if (string.IsNullOrEmpty(lastChanged) ||
    !userRepository.ValidateLastChanged(userPrincipal, lastChanged))
   {
    context.RejectPrincipal();
    await context.HttpContext.Authentication.SignOutAsync("MyCookieMiddlewareInstance");
   }
  }
 }

app.UseCookieAuthentication(options =>
 {
  options.Events = new CookieAuthenticationEvents
  {
   // Set other options
   OnValidatePrincipal = LastChangedValidator.ValidateAsync
  };
 });

await HttpContext.Authentication.SignInAsync(
  "MyCookieMiddlewareInstance",
  principal,
  new AuthenticationProperties
  {
   IsPersistent = true
  });

await HttpContext.Authentication.SignInAsync(
  "MyCookieMiddlewareInstance",
  principal,
  new AuthenticationProperties
  {
   ExpiresUtc = DateTime.UtcNow.AddMinutes(20)
  });

// 1. 在Startup.cs的Configure方法中加上
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
 AuthenticationScheme = "UserAuth",　 // Cookie 驗證方案名稱，在寫cookie時會用到。
 AutomaticAuthenticate = true,　　　 　// 是否自動啟用驗證，如果不啟用，則即便客服端傳輸了Cookie信息，服務(wù)端也不會主動解析。除了明確配置了 [Authorize(ActiveAuthenticationSchemes = "上面的方案名")] 屬性的地方，才會解析，此功能一般用在需要在同一應(yīng)用中啟用多種驗證方案的時候。比如分Area.
 LoginPath = "/User/Index"　　　　　// 登錄頁
});

// 2. 新建UserController
// 3. 創(chuàng)建一個測試登錄的方法（這里為了方便測是我用的是get方法，方便傳參請求）
public IActionResult Login(int userId, string userName)
{
 WriteUser(userId, userName);
 return Content("Write");
}

private async void WriteUser(int userId, string userName)
{
 var identity = new ClaimsIdentity("Forms");  // 指定身份認證類型
 identity.AddClaim(new Claim(ClaimTypes.Sid, userId.ToString()));　　// 用戶Id
 identity.AddClaim(new Claim(ClaimTypes.Name, userName));　　　　　　 // 用戶名稱
 var principal = new ClaimsPrincipal(identity);
 await HttpContext.Authentication.SignInAsync("UserAuth", principal, new AuthenticationProperties { IsPersistent = true , ExpiresUtc = DateTime.UtcNow.AddMinutes(20) }); //過期時間20分鐘
}

// 4. 創(chuàng)建一個退出登錄的方法
public async Task<ActionResult> Logout()
{
 await HttpContext.Authentication.SignOutAsync("UserAuth"); // Startup.cs中配置的驗證方案名
 return RedirectToAction("User", "Index");
}

// 5. 創(chuàng)建一個獲取cookie用戶信息的方法方便調(diào)用
private int GetUserId()
{ 
 //var userName = User.Identity.Name; //獲取登錄時存儲的用戶名稱
 var userId = User.FindFirst(ClaimTypes.Sid).Value; // 獲取登錄時存儲的Id
 if (string.IsNullOrEmpty(userId))
 {
  return 0;
 }
 else
 {
  return int.Parse(userId);
 }
}
// 或者寫一個測試Action
public JsonResult CheckLogin()
{
 var userName = User.Identity.Name; //獲取登錄時存儲的用戶名稱
 var userId = User.FindFirst(ClaimTypes.Sid).Value; // 獲取登錄時存儲的Id
 return Json({UserId:userId,UserName:userName});
}

// 6. 以上是加密的方式如果直接寫好像也是可以的
HttpContext.Response.Cookies.Append("Key", "Value");