Need a way to uniquely identify an application. about hosting HOT 18 CLOSED

@Eilon .. can we prioritize this for beta?

from hosting.

Need to talk to @GrabYourPitchforks about what the design should be for anti-forgery tokens. It's not clear to me that this feature is needed (or that even if it exists, that it will do what is needed for anti-forgery tokens).

from hosting.

Sorry for not including the details in the bug earlier:
The AF system today uses a fixed cookie token name), the problem with that approach is that a development server cookie and an IIS cookie ( for the actual web service) will collide ( this would be the case with two services running on the same server as well).
In web api, we used to generate a cookie based off vdir which served to uniquely differentiate an application.
We could use the application name but since that can be anything (we cant bank on it to be unique), the development scenario would be still broken. Having a unique way of identifying the app would ensure unique cookie name and would avoid the pitfalls mentioned above.

from hosting.

@yishaigalatzer @Eilon will we be taking this for Beta3?

from hosting.

@muratg - this is in his realm now.

from hosting.

@muratg any updates ... dont think we are getting this done for beta3?

from hosting.

@harshgMSFT we need to be closing on beta3 very soon there'a a couple higher pri items for @GrabYourPitchforks. Also not sure if we should rush the design.

@GrabYourPitchforks what do you think?

from hosting.

@muratg @GrabYourPitchforks ping

from hosting.

@muratg ping. We need to converge on this. Lets meet this week and figure out our options.

from hosting.

Adding this to the agenda for next mondays core design meeting, unless you discuss it before then.

from hosting.

@glennc did we get any headway on this ?

from hosting.

@glennc , @muratg I do not see any updates for this since I pinged. Can one of you please update the status?

from hosting.

@harshgMSFT Looks like #177 is describing a way to do this in a specific way, and is assigned to you. Is this one OK to close?

from hosting.

Sure..lets keep the details in both bugs though.

from hosting.

@harshgMSFT See this bug filed by @GrabYourPitchforks: https://github.com/aspnet/Helios/issues/113

from hosting.

Discussed offline with some people. We think the best course of action right now would be to expose this in DataProtection (since only it and MVC require it, and MVC depends on DataProtection) for now. If we can find a legitimate scenario for moving this lower in the dependency chain into DNX or Hosting, then we can do that in a future release. The new API in DataProtection.Interfaces is here.

@harshgMSFT - feel free to resolve as appropriate.

from hosting.

@harshgMSFT Can we close this now?

from hosting.

Closing as we decided to use data protections api.

from hosting.