Claims Cookie Security in ASP.Net Identity

Question

The way I understood it from reading all over the net, is that Claims get stored as cookie, now I add User's Roles to the Claims collection and thus it will be saved into the Claims Cookie. Now this is great as it would save me the round tripping to Database to retrieve user role each time I have Authorization Attribute to check against in my ASP MVC Controller.

• Is this secure?
• Can the cookie be decrypted if stolen?
• Is there an alternative not save Claims in Cookie and save it on server and is this efficient, or am I worried to much?

Answer 1

Cookies are pretty much the standard way to maintain authentication session for a web site. Unless you use cookiless mechanism, which transmits session as a query string and was shown to be less secure. Whether you store claims in the cookie or not, you are still relying on the cookie security mechanism to maintain the client identity between the page hits. The mechanism has been around for years and is considered secure as long as you follow the implementation guidelines from Microsoft.

Assuming you are using .NET 4.5 or .NET 4.0 with WIF libraries, you can cache claims on the server and not send it in the cookie. Here is some basic documentation. Usually it is recommended if you have a lot of claims and the cookie gets too large to carry on every page hit.

Answer 2

As Oleg wrote, the standard cookie encryption is considered secure.

The discussion here < Server side claims caching with Owin Authentication> could be interesting as well.