How to keep Auth-Cookie and (ASP.NET) Session in sync?

Question

We are working on a ASP.NET vNext project and we are implementing simple cookie-based authentication.

We thought about using the auth-cookie just to verify the user is authenticated. It's created like this:

HttpContext.Authentication.SignInAsync();

The user-object itself would be saved to the session-cache (ISession).

Is this a practise one could use or are we thinking about this the entirely the wrong way?
If the basic idea is correct, how do we keep the auth-cookie and the session in sync? (An unauthenticated user with a user-object in the session-cache would be bad)

Note that not only the user-object should be stored in the session. There is a bunch of information that should be stored there (only if the user is authenticated).

Thanks for your input!

Have you made any progress?

Danny van der Kraan
– Danny van der Kraan

2016-04-18 08:51:51 +00:00
Commented Apr 18, 2016 at 8:51 — Danny van der Kraan
– Danny van der Kraan, Commented Apr 18, 2016 at 8:51

Danny van der Kraan · Accepted Answer · 2016-04-14 12:11:49Z

Considering your requirements is it an option for you to use Cookie middleware to persist the user between requests and use Claims-based authorization to persist additional info you want to remember about the user?

So in the Startup class in the Configure method you'd add the cookie middleware for instance like:

            app.UseCookieAuthentication(options =>
        {
            options.AuthenticationScheme = "Cookies";
            options.AutomaticAuthenticate = true;
            options.AutomaticChallenge = true;
            options.LoginPath = new PathString(@"/account/login");
            options.AccessDeniedPath = new PathString(@"/account/accessdenied");

        });

And then in ConfigureServices you can set the claims you require like for instance this:

   services.AddAuthorization(options =>
{
    options.AddPolicy("EmployeeOnly", policy => policy.RequireClaim("EmployeeNumber"));
});

Please consider the links for complete documentation about how to set this up.

Collectives™ on Stack Overflow

How to keep Auth-Cookie and (ASP.NET) Session in sync?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related