Question

For example: if I am retrieving User.Identity.Name, does it come from .ASPXAUTH cookie or is retrieved from the database using my membership provider?

Are any database requests made when I access User.Identity?

Thanks.

---

EDIT: Right now I am pretty sure it comes from an authentication ticket cookie, but can’t find any official documentation to confirm this. Anyone?

Answer 1

This should answer your question…

“The forms authentication ticket not only includes the user’s identity, but also contains information to help ensure the integrity and security of the token.” Excerpted from the following Microsoft article:

http://www.asp.net/security/tutorials/forms-authentication-configuration-and-advanced-topics-vb

In addition to that explanation, observing ASP.NET behavior also supports the conclusion that the username is, in fact, stored in the ASPXAUTH cookie: ASP.NET does NOT hit the database on subsequent page requests after the user has been authenticated. You can prove this yourself, just as I did, by running SQL Profiler to monitor the database as it is used by an ASP.NET application.

Also know that username and authentication ticket data are NOT stored in session state. Aside from raising security concerns, that kind of implementation would cause ASP.NET Membership to break when session state is disabled. Here is another Stack Overflow answer indicating that Forms Authentication (Membership) data and Session State have nothing to do with one another:

Does FormsAuthentication.SetAuthCookie() make a session based cookie?

That answer also links to an MSDN article, here, that explains the ASPXAUTH cookie in detail, though the article I referenced above seems to be more current.