Web applications under same domain override each other authenticated session

Last Updated: Sep 10, 2025

Overview

Two ASP.NET web sites using the Open Web Interface for .NET (OWIN) are deployed under the same domain in IIS as separate applications. Each website is accessed in sequence and in separate browser tabs which allows for user authentication to be completed with success in both. However, when returning to the first site that was accessed the authenticated session is lost.

When the issue occurs, through debugging of the impacted application, it seems that User.Identity becomes unauthenticated.

Applies To

ASP.NET
Domains
Sessions

Cause

By default, OWIN CookieAuthenticationOptions imply that the cookie will be named .AspNet.Cookies and that it will be set at the root path "/". This means that in a scenario where two applications are deployed under the same domain (in separate paths) the cookie set by each application will override the other one as the name is the same and the cookie is set at the domain root path.

Solution

Each application should guarantee that cookies have a unique name that does not clash with the other application cookies or ensure that cookies are set with a Path component specific to the respective application. In the context of OWIN authentication, cookie configuration can generally be customized through (CookieAuthenticationOptions - CookieAuthenticationOptions Properties).