Is putting data in cookies secure?

Question

I am using asp.net mvc 2.0 and I am wondering how secure is it to put information in a cookie?

Like I put in my cookie a forms authentication ticket that is encrypted so can I put information that could be sensitive in there?

string encryptedTicket = FormsAuthentication.Encrypt(authTicket)
HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);

Like I am not storing the password or anything like that but I want to store the UserId because currently every time the user makes a request to my site I have to do a query and get that users Userid, since every table in my db requires you to use the userId to get the right row back.

So these start to add up fast so I rather have it that if a user is authenticated once then that's it till they need to be re-authenticated again. If I would store this userId I could save so many requests to the database.

Yet I don't want it floating around in clear text as potential someone could use it to try to get a row out of a database when they really should not be.

Show how good is this encryption that Authentication uses?

Answer 1

The encryption is good enough, that's not the weak link.

The weak link is that the cookie value could be intercepted, and someone else could impersonate the user.

So, the information in the cookie is safe enough, but you can't protect the cookie itself.