writing a login page and validating the user

Question

I am writing a login page for my site. I was thinking, would generating a random 64bit number and store it in the DB along with a httpOnly cookie be a good way to store the data? then every time a user receives a page (theres a toolbar which says how many new msg he has) to check if the random cookie matches the random cookie + userId in the database.

Is this fine?

BTW using C# ASP.NET

Answer 1

Sounds reasonable to me, provided you have a safe source for the random numbers. Bad (i.e. predictable) random generators are a big security risk.

Answer 2

Perhaps ASP.NET Profiles would help you out. Check out the SqlProfileProvider definition for using a pre-existing Profile Provider. And if your database happens to be something else you could always implement your own.

Answer 3

I recommend using a GUID rather than a random 64 bit number. A GUID is, for all practical purposes, guaranteed to be unique.

As for the security logic you are trying to implement, I can't comment on whether it will work if and only if you employ this pattern as more information is required in the question.