Search code examples
securityasp.net-corecookiesasp.net-identitysession-cookies

Is it right way to store security fields in cookies?

I trying to store extra fields in cookies with ASP.Net Core Identity.

one of this fields, is Role Name.

Is it safe to store role name in cookies?

For example, is it possible that user change role name from "normalUser" to "admin"?

I am using ASP.Net Core 3.1 version.

Solution

  • NEVER store sensitive data in cookies. As mason said in the comment, cookies can be modified meaning they can be exploited. And besides, your cookies might be in plaintext, which is even worse.

    I would recommend storing such data securely in the backend.

    Sessions are definitely safer than cookies since they are stored on the server side but they also can be subject to attacks (session hijacking). You'll need to properly configure them for better security.