asp.net - Forms Authentication across virtual directories -

i trying share forms auth root application sub application running in virtual directory. having trouble authentication in subsite.

in parent application works expected.

i have following setup:

parent application:

• url: http://localhost:1336/
• <forms loginurl="~/account/sign-in" protection="all" timeout="30" name=".myapplication" path="/" requiressl="false" slidingexpiration="true" cookieless="usedeviceprofile" enablecrossappredirects="true" defaulturl="/" />

virtual directory:

• url: http://localhost:1336/subsite
• <forms loginurl="/account/sign-in" protection="all" timeout="30" name=".myapplication" path="/" requiressl="false" slidingexpiration="true" cookieless="usedeviceprofile" enablecrossappredirects="true" defaulturl="/" />

when try http://localhost:1336/subsite following flow:

• get http://localhost:1336/subsite -> 302 /account/sign-in?returnurl=%2fsubsite (looks ok)
• enter user/password
• post http://localhost:1336/account/sign-in?returnurl=%2fsubsite -> 302 /subsite (great auth looks successful)
• get http://localhost:1336/subsite -> 302 /account/sign-in?returnurl=%2fsubsite (ie subsite doesnt think authenticated)

also can see cookie in list in browser (so there)

what have got wrong in config that's stopping subsite sharing parent cookie?

i running on iisexpress

in web.config files, set common machine key between projects 2 domains share validation , decryption keys.

example:

<machinekey validationkey="21f090935f6e49c2c797f69bbaad8402abd2ee0b667a8b44ea7dd4374267a75d7"  decryptionkey="abaa84d7ec4bb56d75d217cecffb9628809bdb8bf91cfcd64568a145be59719f" validation="sha1" decryption="aes" />