Storing more information using FormsAuthentication.SetAuthCookie

Question

I am using aspx and c# for a setting a authentication cookie for a login. FormsAuthentication.SetAuthCookie(UserName, True)

I want to store more information in the same cookie. Can I add values to this authentication cookie or do I have to use a second http cookie?

Basically I'm looking for away to store the User's Id so I may be able to access the database using the users table row key

Thanks, Eden

Answer 1

You cannot change the value of the authentication cookie.

What if someone changes the value of that UserId cookie? Keep that information away from the user and store it on your server, maybe in the session object.

Answer 2

putting the userId in a cookie is not really a good idea, it can be changed by the client, save it in a session.

Answer 3

Pass that user ID as the userName param.

FormsAuthentication.SetAuthCookie(userId, True)

How are you securing your auth tickets?

Answer 4

You can put whatever you want in the auth cookie as long as it's useful to you. That said, if you're putting sensitive information you should, at the very least, encrypt it, but I'd recommend against putting sensitive information there. You can do something like:

Forms.SetAuthCookie (UserName + "|" + UserId, true);

Then, whenever you need the username or the user id, it is there. Just load the cookie and parse out the values you need.

Again, I'd advise against doing this, especially as I have it presented above. That said, it is possible. You should create accessor methods to pull the data back out:

public int CurrentUserId
{
    get
    {
        int userId = 0;

        if (HttpContext.Current.Request.IsAuthenticated)
        {
            userId = Convert.ToInt32(HttpContext.Current.User.Identity.Name.Split('|')[1]);
        }

        return userId;
    }
}

public string CurrentUserName
{
    get
    {
        string userName = string.Empty;

        if (HttpContext.Current.Request.IsAuthenticated)
        {
            userName = HttpContext.Current.User.Identity.Name.Split('|')[0];
        }

        return userName;
    }
}

Answer 5

You can add user data to the FormsAuthenticationTicket, then generate the cookie yourself.

There's an example in the the MSDN documentation for FormsAuthenticationTicket.