WIF Sessions and Case-Sensitivity

Question

I'm getting behavior from my WIF web application that I don't yet understand. When I call the app, the standard interaction happens:

1. call app (https://localhost/MyApp1/)
2. app redirects the browser to my STS (in this case ADFS 2.0)
3. user authenticates to the STS
4. STS sends token to my app
5. session cookie is created in my app for the WIF session

From then on, if I navigate to https://localhost/MyApp1/[anything], all is good and I see that my WIF session is being used.

However, if I navigate to the app with different casing for the URL, like https://localhost/myapp1/[anything], the WIF session is not recognized and I see a redirect back to the STS for authentication.

I have 2 questions:

1. What am I missing? Is it case-sensitivity of the cookies? Is it WIF configuration?
2. What is the solution? Put a rule into my web.config? Is there a way to make my solution not case-sensitive?

Thanks.

Answer 1

I think this is your problem:

http://brockallen.com/2013/02/08/beware-wif-session-authentication-module-sam-redirects-and-webapi-services-in-the-same-application/

The real answer is that URLs are case-sensitive :/