.Net Core Cookie Authentication Not Working When hosted in IIS
I think the problem might be left over or overlapping cookies from a different "localhost" application with the same cookie name. I ran your sample in IIS and was getting the same 401 error from the ping and then noticed in chrome a bunch of localhost cookies with that same default name
.AspNetCore.CookieAuth
I cleared out all of the cookies and then ran your sample again and got back a "PONG"
The cookies that get created when you're using IISEXPRESSlocalhost:PORT
will also come down when you're running in IIS with just localhost, so my guess is that the IISEXPRESS cookies are being sent to the IIS instance and since you have ephemeral data protection they aren't going to be able to decrypt.