title: Why IdentityServer4 provide/send-back different cookie for each clients?
body: <p>I have two mvc client application <code>mvc_client1</code> and <code>mvc_client2</code>. When I logged into <code>mvc_client1</code> and click the menu to launch <code>mvc_client2</code> automatically authenticate and open authorized page as per <code>IdentityServer4</code> documentation.</p>
  
  <p>But, if I trigger logout from any of the client only logout the client which I requested the logout. I have already read documentation and implemented <code>Back-Channel-Logout</code>. Even though single sign-out not working as documented.</p>
  
  <p>I noticed something that, Identity server provide/send-back different cookie value for each client when authorize. Will it causes an single sign-out? <em>(Please refer attached image)</em> If yes, how to resolve this?</p>
  
  <p>Or, Is this because of recent <code>SameSite</code> update in all modern browsers?</p>
  
  <p><strong>Client1:</strong></p>
  
  <p><a href="https://i.stack.imgur.com/PEHjc.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/PEHjc.png" alt="Client 1"></a></p>
  
  <p><strong>Client2:</strong></p>
  
  <p><a href="https://i.stack.imgur.com/Vlskq.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Vlskq.png" alt="Client 2"></a></p>
  
  <h2>EDIT :</h2>
  
  <p><strong>IdentityServer Project's Startup:</strong></p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      //...
  
      //...
      services.AddIdentityServer()
          .AddInMemoryIdentityResources(IdentityConfiguration.GetIdentityResources())
          .AddInMemoryClients(IdentityConfiguration.GetClients())
          .AddDeveloperSigningCredential()
          .AddProfileService&lt;CustomProfileService&gt;()
          .AddResourceOwnerValidator&lt;ResourceOwnerPasswordValidator&gt;();
  }
  </code></pre>
  
  <p><strong>Client Project's Startup:</strong></p>
  
  <pre><code>public void Configuration(IAppBuilder app)
  {
      JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary&lt;string, string&gt;();
  
      app.UseCookieAuthentication(new CookieAuthenticationOptions
      {
          AuthenticationType = "Cookies",
          CookieSecure = CookieSecureOption.SameAsRequest,
          CookieHttpOnly = true,
          ExpireTimeSpan = TimeSpan.FromMinutes(180),
      });
  
      app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
      {
          Authority = "https://localhost:44306/",
  
          ClientId = "mvc_client1",
          ClientSecret = "secret",
          Scope = "openid profile",
          ResponseType = "code id_token",
          RedirectUri = "https://localhost:44307/",
  
          SignInAsAuthenticationType = "Cookies",
          UseTokenLifetime = false,
          RequireHttpsMetadata = true,
  
          Notifications = new OpenIdConnectAuthenticationNotifications
          {
              SecurityTokenValidated = n =&gt;
              {
                  var id = n.AuthenticationTicket.Identity;
                  id.AddClaim(new Claim("id_token", n.ProtocolMessage.IdToken));
                  n.AuthenticationTicket = new AuthenticationTicket(
                         id,
                         n.AuthenticationTicket.Properties);
                  return Task.FromResult(0);
              },
  
              RedirectToIdentityProvider = n =&gt;
              {
                  if (IsAjaxRequest(n.Request))
                  {
                      n.Response.StatusCode = 401;
                      n.Response.Headers.Remove("Set-Cookie");
                      n.State = NotificationResultState.HandledResponse;
                  }
  
                  switch (n.ProtocolMessage.RequestType)
                  {
                      case Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectRequestType.Authentication:
                          {
                              n.OwinContext.Authentication.SignOut("Cookies");
                              break;
                          }
                      case Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectRequestType.Logout:
                          {
                              var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token");
                              if (idTokenHint != null)
                              {
                                  n.ProtocolMessage.IdTokenHint = idTokenHint.Value;
                                  n.ProtocolMessage.ClientId = ConfigurationManager.AppSettings["ClientID"];
                              }
                              break;
                          }
                  }
  
                  return Task.FromResult(0);
              }
          }
      });
  }
  
  private bool IsAjaxRequest(IOwinRequest request)
  {
      IReadableStringCollection query = request.Query;
      if ((query != null) &amp;&amp; (query["X-Requested-With"] == "XMLHttpRequest"))
      {
          return true;
      }
      IHeaderDictionary headers = request.Headers;
      return (headers != null) &amp;&amp; (headers["X-Requested-With"] == "XMLHttpRequest");
  }
  </code></pre>
  
  <p><strong>My Client Configuration:</strong></p>
  
  <pre><code>public static IEnumerable&lt;IdentityResource&gt; GetIdentityResources() =&gt;
  new List&lt;IdentityResource&gt;
  {
      new IdentityResources.OpenId(),
      new IdentityResources.Profile(),
  };
  
  public static IEnumerable&lt;Client&gt; GetClients() =&gt;
  new List&lt;Client&gt; {
      new Client {
          ClientName = "MVC Client 1",
          ClientId = "mvc_client1",
          AllowedGrantTypes = GrantTypes.Hybrid,
          ClientSecrets =
          {
              new Secret("secret".Sha256())
          },
          RedirectUris = new List&lt;string&gt;
          {
              "https://localhost:44307/"
          },
          PostLogoutRedirectUris = new List&lt;string&gt;
          {
              "https://localhost:44307/"
          },
          AllowedScopes =
          {
              IdentityServerConstants.StandardScopes.OpenId,
              IdentityServerConstants.StandardScopes.Profile
          },
          AlwaysIncludeUserClaimsInIdToken = true,
          RequireConsent = false,
          BackChannelLogoutSessionRequired = true,
          BackChannelLogoutUri = "https://localhost:44307/Home/SignoutOidc",
          Properties = new Dictionary&lt;string, string&gt;()
          {
              {"ForgetPasswordUri", "https://localhost:44307/account/forgotpassword" },
              {"SubscribeUri", ""https://localhost:44307/account/register" }
          }
      }
  };
  </code></pre>