How do I keep the FedAuth Cookie from ClaimsPrincipal from being shared between two websites that share a common domain? - cross-domain

Question

I have two websites:
global.domain.com and global.domain.com/site1
/site one is an Application added to IIS under global.domain.com's site.
users will sign into global.domain.com, and then click on a link to global.domain.com/site1 to get there. Since I'm using matching machineKeys, and info in this article:
http://msdn.microsoft.com/en-us/library/eb0zx8fc.aspx
I am setting a Forms Auth cookie, and that's allowing a single user to be "authenticated" between sites across the same domain.
I'm also using ClaimsPrincipal in each site to handle assignment of roles via the new claims in .NET 4.5.
But when the user is either clicking on, or typing in the site for /site1, site1 one is getting the claims for the global site, and I do NOT want that to happen.
If I have a direct link to /site1 from the global site, I can use a controller action to redirect the user after calling:
FederatedAuthentication.SessionAuthenticationModule.SignOut();
and that clears the FedAuth cookie.
But if the user just adds /site1 to the back of the global site's URL and hits go, then the claims from Global carry to the Claims for /site1.
Each site should have its own claims...
I've tried removing the FedAuth cookie in my PostAuthenticate handler in Global.asax:
protected void Application_PostAuthenticateRequest()
{
if (HttpContext.Current.Request.UrlReferrer == null)
{
FederatedAuthentication.SessionAuthenticationModule.SignOut();
HttpContext.Current.Request.Cookies.Remove("FedAuth");
return;
}
}
but that doesn't seem to do the trick, b/c if I put a break on the first line of Application_PostAuthenticateRequest and look at the ClaimsPrincipal.Current.Identities.First().Claims collection, all the claims are there from global.
So even if I call SessionAuthenticationModule.SignOut(); and delete FedAuth cookie, I still have to find a way to remove the Claims from the ClaimsPrincipal.Current, and that seems a little "hackish".
Does anyone know where and or when ClaimsPrincipal.Current gets assigned? Since it has my claims from the global site when accessing /site1 before hitting my handler in Global.asax, there must be somewhere else in the pipeline that's populating the ClaimsPrincipal.Current's claims...
any ideas?

Answer 1

to prevent a FedAuth cookie from working across applications in the same domain, configure a cookie handler with a unique path for each application.
Do your applications have a cookie handler path set to "/" ? If yes, then this is allowing the FedAuth cookie to be shared across the applications.
Try setting the cookie handler path to something unique... such
<cookieHandler path="/myapplicationpath/" />
or - leaving path attribute out completely should accomplish the same thing.