I'm writing a database authentication system for my web application which is wrriten in ASP.NET MVC. When someone authorize, it should save his username in cookies. Is it safe to just use HttpResponse.Cookies` for saving a cookie that its value is username? Wouldn't it forgeable?
Saving only the username... Is it the right and safe way? Or should I save the whole User object (if this actually possible)?
Thank you and sorry for my English.
No, saving the username is very insecure, because it can be easily faked. Here are my guidelines:
Tokens can be generated by a CSPRNG to ensure that the auto-login cookie can not be faked.
Hashing the tokens in the database prevents user account stealing in the case that you database is compromised. (Remember, the token at this point is a password-equivalent.)
HTTP-Only cookies prevent XSS attacks that could potentially steal the cookie.
If you store the username in the cookie then its very easy for someone to change that.
A better approach would be to store a session id (which you have generated) in the cookie and hang things like the username off that in your server.
No, saving the user name in a cookie to flag that the user it authorizes is not the right way, and it's definitely not safe.
It would be quite easy to edit the cookie to be someone else's user name, and voila! you are now authorized as that user.
Instead you should store some information in the cookie that is not specific to the user, but is specific to the user session. You could create a value from the browser string (scrambled in some way to make it less obvious) and store the value both in the cookie and in the session data on the server. When the user sends the next request, you can verify that the value comes from the same session and the same browser configuration.
It's of course not totally safe, as you can spoof both cookie data and browser string, but it's a lot safer than putting the user name in a cookie, and somwhat safer than only relying on the session id.
To get an authentication that is really safe, you have to use SSL.
Use the built-in forms authentication framework to handle the HTTP transport end of the world and avoid reinventing the wheel.
PS: before someone downvotes, remember that FormsAuthentication != using the SqlMembershipProvider.