I found a tricky way how to solve it. We don't want to rewrite our code and we have a lot of content finders, so we decided to use this:

    public static void SetPrincipalForHttpContext(this HttpContext context)
    {
        var ticket = context.DecryptAuthCookie();
        if (ticket == null) return;
        context.User = ticket.Principal;
    }
    public static AuthenticationTicket DecryptAuthCookie(this HttpContext httpContext)
    {
        // ONE - grab the CookieAuthenticationOptions instance
        var opt = httpContext.RequestServices
            .GetRequiredService<IOptionsMonitor<CookieAuthenticationOptions>>()
            .Get("Identity.Application"); //or use .Get("Cookies")
        // TWO - Get the encrypted cookie value
        var cookie = opt.CookieManager.GetRequestCookie(httpContext, opt.Cookie.Name);
        // THREE - decrypt it
        return opt.TicketDataFormat.Unprotect(cookie);
    }

It's dirty, but works. (You can use this method in your content finder)