CODEWITHSUNDEEP
asp.netasp.net-mvcsessionauthenticationcookies
Serge P.
Serge P.

Reputation: 327

Store session token on ASP .NET server

I'm new to Web. Now I'm trying to develop custom user authentication using cookies. When user logins I supply server responce with cookie which contains userId and randomly generated session token guid. When user then requests to the server, it extracts authentication cookie from request, so the server gets back information about userId and user session.

My question is: where should I store and check session token which comes along with users' requests? What if malefactor will falsify cookie with fake userId and session token?

Now there is no place in my program where I store and then check mappings between userId and their session tokens.

Upvotes: 0

Views: 2043

Answers (1)

Andrei
Andrei

Reputation: 44600

To enforce security of your ASP.NET MVC application you can use Anti Forgery Tokens.

I recommend you not to implement your "custom" user authentication but look at ASP.NET Identity. It is very flexible and covers most of the necessary authentication scenarios.

Upvotes: 1

Related Questions