Need a way to uniquely identify an application.

[harshgMSFT]

This is needed for
aspnet/Mvc#584

[harshgMSFT]

@Eilon .. can we prioritize this for beta?

[Eilon]

Need to talk to @GrabYourPitchforks about what the design should be for anti-forgery tokens. It's not clear to me that this feature is needed (or that even if it exists, that it will do what is needed for anti-forgery tokens).

[harshgMSFT]

Sorry for not including the details in the bug earlier:
The AF system today uses a fixed cookie token name), the problem with that approach is that a development server cookie and an IIS cookie ( for the actual web service) will collide ( this would be the case with two services running on the same server as well).
In web api, we used to generate a cookie based off vdir which served to uniquely differentiate an application.
We could use the application name but since that can be anything (we cant bank on it to be unique), the development scenario would be still broken. Having a unique way of identifying the app would ensure unique cookie name and would avoid the pitfalls mentioned above.

[harshgMSFT]

@yishaigalatzer @Eilon will we be taking this for Beta3?

[Eilon]

@muratg - this is in his realm now.

[harshgMSFT]

@muratg any updates ... dont think we are getting this done for beta3?

[muratg]

@harshgMSFT we need to be closing on beta3 very soon there'a a couple higher pri items for @GrabYourPitchforks. Also not sure if we should rush the design.

@GrabYourPitchforks what do you think?

[yishaigalatzer]

@muratg @GrabYourPitchforks ping

[harshgMSFT]

@muratg ping. We need to converge on this. Lets meet this week and figure out our options.

[glennc]

Adding this to the agenda for next mondays core design meeting, unless you discuss it before then.

[harshgMSFT]

@glennc did we get any headway on this ?

[harshgMSFT]

@glennc , @muratg I do not see any updates for this since I pinged. Can one of you please update the status?

[muratg]

@harshgMSFT Looks like #177 is describing a way to do this in a specific way, and is assigned to you. Is this one OK to close?

[harshgMSFT]

Sure..lets keep the details in both bugs though.

[muratg]

@harshgMSFT See this bug filed by @GrabYourPitchforks: https://github.com/aspnet/Helios/issues/113

[GrabYourPitchforks]

Discussed offline with some people. We think the best course of action right now would be to expose this in DataProtection (since only it and MVC require it, and MVC depends on DataProtection) for now. If we can find a legitimate scenario for moving this lower in the dependency chain into DNX or Hosting, then we can do that in a future release. The new API in DataProtection.Interfaces is here.

@harshgMSFT - feel free to resolve as appropriate.

[muratg]

@harshgMSFT Can we close this now?

[harshgMSFT]

Closing as we decided to use data protections api.