Q: OWIN - Forbid sharing of cookies between subdomains I have simple application with following OWIN auth setup:
    public partial class Startup
    {
        public void ConfigureAuth(IAppBuilder app)
        {
            var options = new CookieAuthenticationOptions
            {                
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                CookieName = "app",
            };

            options.ExpireTimeSpan = TimeSpan.FromHours(2);
            options.LoginPath = new PathString("/account/login");
            options.Provider = new CookieAuthenticationProvider
            {
                OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<UserManager, IdentityUser, Guid>(
                    TimeSpan.FromSeconds(30),
                    (manager, user) => user.GenerateUserIdentityAsync(manager),
                    claim => Guid.Parse(claim.GetUserId()))
            };

            app.UseCookieAuthentication(options);
        }
    }

If I host application on two subdomains test.app.com and demo.app.com, I need to log in into both applications separately, which is good.
But, if I use Fiddler to catch request/response, extract cookies from test.app.com and using Fiddler to access demo.app.com with same cookies, it will return results.
I'm wondering, how we can prevent this, to disable access with same cookies from one subdomain to another subdomain.
I have single instance of application and both subdomains point to it.
Thank you!
