<script>
    $(function () {
        $("#submit").click(function () {
            $("#postForm").ajaxSubmit(function (result) {
                if (result.success) {
                    var token = getToken();
                    if (token) {
                        var authorizeHostArray = new Array(
                            "http://www.web1.com/Token/Authorization",
                            "http://www.web2.com/Token/Authorization"
                        );
                        var authorizeHostParams = "";
                        authorizeHostArray.forEach(function (item) {
                            authorizeHostParams += "&hostAuthorization=" + item;
                        });
                        window.location.href = authorizeHostArray[0] + "?token=" + token + authorizeHostParams;
                    }
                } else {
                    alert(result.msg);
                }
            });
        });

        function getToken() {
            var token = null;
            $.ajax({
                url: "/api/Token",
                type: "GET",
                async: false,
                success: function (d) {
                    token = d.token;
                }
            });
            return token;
        }
    });
</script>

public class TokenController : Controller
    {
        public static TokenCookieOptions CookieOptions { get; set; }

        public IActionResult Authorization(string token, List<string> hostAuthorization = null)
        {
            if (CookieOptions == null || string.IsNullOrEmpty(token))
                return BadRequest();

            HttpContext.Response.Cookies.Append(CookieOptions.Name, token, new CookieOptions
            {
                Domain = CookieOptions.Domain,
                Expires = DateTimeOffset.UtcNow.Add(CookieOptions.Expires),
                HttpOnly = CookieOptions.HttpOnly,
                IsEssential = CookieOptions.IsEssential,
                MaxAge = CookieOptions.MaxAge,
                Path = CookieOptions.Path,
                SameSite = CookieOptions.SameSite
            });

            if (hostAuthorization.Any())
                hostAuthorization = hostAuthorization.Where(a => !a.Contains(HttpContext.Request.Host.Host)).ToList();

            if (!hostAuthorization.Any())
                hostAuthorization = new List<string> { "http://www.sso.com" };

            return View(new TokenViewData
            {
                Token = token,
                HostAuthorization = hostAuthorization
            });
        }

        public IActionResult Logout(List<string> hostAuthorization = null)
        {
            HttpContext.Response.Cookies.Delete(CookieOptions.Name);

            if (hostAuthorization.Any())
                hostAuthorization = hostAuthorization.Where(a => !a.Contains(HttpContext.Request.Host.Host)).ToList();

            if (!hostAuthorization.Any())
                hostAuthorization = new List<string> { "http://www.sso.com" };

            return View(new TokenViewData
            {
                HostAuthorization = hostAuthorization
            });
        }
    }

public void ConfigureServices(IServiceCollection services)
        {
            services.AddMvc();
            services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                .AddCookie(options =>
               {
                   options.Cookie.Name = "Token";
                   options.Cookie.HttpOnly = true;
                   options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
                   options.LoginPath = "/Account/Login";
                   options.LogoutPath = "/Account/Logout";
                   options.SlidingExpiration = true;
                   //options.DataProtectionProvider = DataProtectionProvider.Create(new DirectoryInfo(@"D:\sso\key"));
                   options.TicketDataFormat = new TicketDataFormat(new AesDataProtector());
                   TokenController.CookieName = options.Cookie.Name;
               });
        }

internal class AesDataProtector : IDataProtector
    {
        private const string Key = "!@#13487";

        public IDataProtector CreateProtector(string purpose)
        {
            return this;
        }

        public byte[] Protect(byte[] plaintext)
        {
            return AESHelper.Encrypt(plaintext, Key);
        }

        public byte[] Unprotect(byte[] protectedData)
        {
            return AESHelper.Decrypt(protectedData, Key);
        }
    }