title: How do I keep the FedAuth Cookie from ClaimsPrincipal from being shared between two websites that share a common domain?
body: <p>I have two websites:</p>
  
  <p>global.domain.com and global.domain.com/site1</p>
  
  <p>/site one is an Application added to IIS under global.domain.com's site.</p>
  
  <p>users will sign into global.domain.com, and then click on a link to global.domain.com/site1 to get there. Since I'm using matching machineKeys, and info in this article:</p>
  
  <p><a href="http://msdn.microsoft.com/en-us/library/eb0zx8fc.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/eb0zx8fc.aspx</a></p>
  
  <p>I am setting a Forms Auth cookie, and that's allowing a single user to be "authenticated" between sites across the same domain.</p>
  
  <p>I'm also using ClaimsPrincipal in each site to handle assignment of roles via the new claims in .NET 4.5.</p>
  
  <p>But when the user is either clicking on, or typing in the site for /site1, site1 one is getting the claims for the global site, and I do NOT want that to happen.</p>
  
  <p>If I have a direct link to /site1 from the global site, I can use a controller action to redirect the user after calling:</p>
  
  <pre><code>FederatedAuthentication.SessionAuthenticationModule.SignOut();
  </code></pre>
  
  <p>and that clears the FedAuth cookie.</p>
  
  <p>But if the user just adds /site1 to the back of the global site's URL and hits go, then the claims from Global carry to the Claims for /site1.</p>
  
  <p>Each site should have its own claims...</p>
  
  <p>I've tried removing the FedAuth cookie in my PostAuthenticate handler in Global.asax:</p>
  
  <pre><code> protected void Application_PostAuthenticateRequest()
   {
          if (HttpContext.Current.Request.UrlReferrer == null)
          {
              FederatedAuthentication.SessionAuthenticationModule.SignOut();
              HttpContext.Current.Request.Cookies.Remove("FedAuth");
              return;
          }
   }
  </code></pre>
  
  <p>but that doesn't seem to do the trick, b/c if I put a break on the first line of Application_PostAuthenticateRequest and look at the ClaimsPrincipal.Current.Identities.First().Claims collection, all the claims are there from global.</p>
  
  <p>So even if I call SessionAuthenticationModule.SignOut(); and delete FedAuth cookie, I still have to find a way to remove the Claims from the ClaimsPrincipal.Current, and that seems a little "hackish".</p>
  
  <p>Does anyone know where and or when ClaimsPrincipal.Current gets assigned? Since it has my claims from the global site when accessing /site1 before hitting my handler in Global.asax, there must be somewhere else in the pipeline that's populating the ClaimsPrincipal.Current's claims...</p>
  
  <p>any ideas?</p>