With MVC 2, how do I stop one app logout from logging out the user in a second app?

Question

In VS2010 I have two MVC 2 based web apps within the same solution that also share a common Setup project. One app is a configuration utility for setting up users and variables in the opposing app. Upon installation, the two IIS directories look like this on the user's browser: App1: http://localhost/App1/Auth/Login App2: http://localhost/App1/App2/Auth/Login

The problem I'm having is when the user has both apps open at the same time, and logs out of one of them they are also logged out of the opposing app. This is a minor issue, but I've been tasked with correcting it.

From what I can tell, the two apps must be sharing the same Session object, because the logout command method in each controller invokes Session.Abandon() .

Only two controllers have the ability to log out a user; here's the constructor's from those controller's:

App1: namespace App1.Controllers

/// <summary>
/// Functionality related to Assets
/// </summary>
public class AssetsController : Controller
{
private IConfig _config = null;
private IProfileRepository _profiles = null;
private IInspectionRepository _inspections = null;
private ICustomLabelsFactory _labels = null;
private IValidateRepository _validator = null;

/// <summary>
/// Create an instance of the AssetsController which uses the db.
/// </summary>
public AssetsController() : this(Config.Current, new ProfileRepository(Config.Current), new InspectionRepository(), new CustomLabelFactory(), new ValidateRepository()) { }

/// <summary>
/// Create an instance of the AssetsController with the given
/// IInspectionRepository implementation.
/// </summary>
/// <param name="inspections">IInspectionRepository implementation.</param>
public AssetsController(IConfig config, IProfileRepository profiles, IInspectionRepository inspections, ICustomLabelsFactory labels, IValidateRepository validator)
    : base()
{
    ViewData["_Module"] = "Assets";

    _config = config;

    _profiles = profiles;
    _profiles.ModelState = ModelState;

    _inspections = inspections;
    _inspections.ModelState = ModelState;

    _labels = labels;
    _labels.ModelState = ModelState;

    _validator = validator;
    _validator.CustomLabels = _labels.Assets;
    _validator.ModelState = ModelState;
}

App2: namespace App1.App2.Controllers

/// <summary>
/// Handles login/logout functionality
/// </summary>
public class AuthController : Controller
{
private ILoginService _login;
private IUtilityRepository _utility;

/// <summary>
/// Creates the Auth controller using the default User Repository which
/// uses the database.
/// </summary>
public AuthController() : this(new LoginService(), new UtilityRepository()) { }

/// <summary>
/// Creates the Auth controller with the given User Repository.
/// </summary>
/// <param name="userRepository">IUserRepository implementation.</param>
public AuthController(ILoginService loginService, IUtilityRepository utility)
    : base()
{
    ViewData["_Module"] = "Login";

    _login = loginService;
    _login.ModelState = ModelState;

    _utility = utility;
    _utility.ModelState = ModelState;
}

I might be barking up the wrong tree on where to start looking at the code, but I'm hoping someone can see something obvious here that I can't. Or, maybe someone can tell me how to do this differently so there is not a shared Session object involved. I've been working on this on and off for the better part of this week, so any help offered will be greatly appreciated.

Answer 1

You could configure each application to use a different session database in your web.config

EDIT: something like

<sessionState mode="SQLServer" sqlConnectionString="Data Source=.\SQLEXPRESS;User Id=test;Password=test;Application Name=AppName"  />
    <machineKey
validationKey="SOMEKEY"
validation="SHA1" decryption="AES"
/>

Where somekey is different for each application

Answer 2

A simple, lazy, IIS settings avoiding solution is to open each in a different browser.