Edited:

As Described in https://docs.microsoft.com/en-us/aspnet/core/security/gdpr?view=aspnetcore-2.2#tempdata-provider-and-session-state-cookies-arent-essential by default TempData cookies are removed by the CookiePolicy Middleware. this can be changed by putting this in Startup.ConfigureServices():

// The TempData provider cookie is not essential. Make it essential
// so TempData is functional when tracking is disabled.
services.Configure<CookieTempDataProviderOptions>(options => {
    options.Cookie.IsEssential = true;
}); 

=============================================

Old Answer:

After Migrating to ASP Core 2.1 I had this issue and after working for a day find the solution:

in Startup.Configure() app.UseCookiePolicy(); should be after app.UseMVC();


Nothing's wrong with middleware order as described on official docs, which is:

  1. Exception/error handling
  2. HTTP Strict Transport Security Protocol
  3. HTTPS redirection
  4. Static file server
  5. Cookie policy enforcement
  6. Authentication
  7. Session
  8. MVC

But when we use Cookie policy enforcement (UseCookiePolicy), only essential cookie that will be sent to the browser and Cookie from Tempdata provider is not essential hence the problem. So we have to make it essential according to official documentation:

The Tempdata provider cookie isn't essential. If tracking is disabled, the Tempdata provider isn't functional. To enable the Tempdata provider when tracking is disabled, mark the TempData cookie as essential in Startup.ConfigureServices

// The Tempdata provider cookie is not essential. Make it essential
// so Tempdata is functional when tracking is disabled.
services.Configure<CookieTempDataProviderOptions>(options => {
   options.Cookie.IsEssential = true;
});

Adding those lines should solve your issue without reordering middleware.