Windows Identity Foundation - Change cookie name

After authenticating through WIF, a FedAuth cookie is generated containing all your claims. We got a situation where this caused issues as the same cookie name was used for different applications. One FedAuth cookie was generated at the root level and was applicable for all sub sites. Every site generated it’s own FedAuth cookie that was applicable for that specific subsite only.

This caused conflicts when you navigate from one of the subsites to the root site. As a FedAuth cookie is found, it is used to try to extract the claims. But this doesn’t work as the cookie isn’t generated for this website.

To fix it, we changed the cookiename in the WIF configuration to use a different name and avoid name collisions:

• This can be done by setting the name attribute on the cookiehandler(more info: https://docs.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/windows-identity-foundation/cookiehandler)

	<system.identityModel.services>
	<federationConfiguration>
	<cookieHandler requireSsl="true" name="AppNameAuth" />
	<wsFederation passiveRedirectEnabled="false" issuer="https://adfs2.vlm.be/adfs/ls/" realm="https://localhost/AppName/FederationResult/" requireHttps="true" />
	</federationConfiguration>
	</system.identityModel.services>

view raw web.config hosted with ❤ by GitHub