23

The way I understood it from reading all over the net, is that Claims get stored as cookie, now I add User's Roles to the Claims collection and thus it will be saved into the Claims Cookie. Now this is great as it would save me the round tripping to Database to retrieve user role each time I have Authorization Attribute to check against in my ASP MVC Controller.

  • Is this secure?
  • Can the cookie be decrypted if stolen?
  • Is there an alternative not save Claims in Cookie and save it on server and is this efficient, or am I worried to much?
Improve this question

2 Answers 2

Reset to default
13

Cookies are pretty much the standard way to maintain authentication session for a web site. Unless you use cookiless mechanism, which transmits session as a query string and was shown to be less secure. Whether you store claims in the cookie or not, you are still relying on the cookie security mechanism to maintain the client identity between the page hits. The mechanism has been around for years and is considered secure as long as you follow the implementation guidelines from Microsoft.

Assuming you are using .NET 4.5 or .NET 4.0 with WIF libraries, you can cache claims on the server and not send it in the cookie. Here is some basic documentation. Usually it is recommended if you have a lot of claims and the cookie gets too large to carry on every page hit.

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

thanks a lot for the info, really appreciate it,maybe i am wrong but the link you gave me does not seem to work with ASP.NET MVC 5.1 Owin
Yes, sorry, this is pre-OWIN code, was not sure what version of MVC you were using. There is no built-in server side caching for the Owin cookie at this time, so you'll have to roll your own as IliaJ posted.
7

As Oleg wrote, the standard cookie encryption is considered secure.

The discussion here < Server side claims caching with Owin Authentication> could be interesting as well.

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.