Repeated cookie query or Storing in viewstate? Which is the better practice?

Question

I have a internal website that users log into. This data is saved as a cookie. From there the users go on their merry way. Every so often the application(s) will query the authentication record to determine what permissions the user has.

My question is this: Is it more efficent to just query the cookie for the user data when it is needed or to save the user information in viewstate?

[Edit] As mentioned below, Session is also an option.

Answer 1

Personally, I prefer using a session to store things, although the other developers here seem to think that's a no-no.

There is one caveat: You may want to store the user's IP in the session and compare it to the user's current IP to help avoid session hijacking. Possibly someone else here has a better idea on how to prevent session hijacking.

Answer 2

You can use session data - that way you know that once you have stored it there, users can't fool around with it by changing the query string.

Answer 3

Viewstate is specific to the page they are viewing, so its gone once they go along thier merry way. Not a good way to persist data.

Your best bet is to use Forms Authentication, its built in to ASP.NET and you can also shove any user-specific information into the Forms Authentication Ticket's Value. You can get 4000 bytes in (after encrypting) there that should hold whatever you need. It will also take care of allowing and denying users access to pages on the site, and you can set it to expire whenever you need.

Storing in the session is a no-no because it scales VERY poorly (eats up resources on the server), and it can be annoying to users with multiple browser connections to the same server. It is sometimes unavoidable, but you should take great pains to avoid it if you can.

Answer 4

I would use the cookie method. Session is okay but gets disposed by asp.net on recompile, and you have to use a non session cookie if you want to persist it after session anyway. Also if you ever use a stateserver its essentially doing the same thing (stores session in the db). Session is like a quick and dirty fix, real men use cookies.