Home/ Questions/Q 6798827
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T18:46:36+00:00

I’m re-writing a website from the ground up for azure. Each user has ownership

  • 0

I’m re-writing a website from the ground up for azure. Each user has ownership of a number of objects, and has a number of permissions. Together, these determine what they are authorized to do. The question is, how should this information be stored. I want to do the authentication myself, using custom logic.

For performance reasons, I’d like to cache these authorization lists for each user once they’re logged in. Can someone give me a sample for how to store & access this session information securely and efficiently.

Edit

I looked into the App Fabric Access Control, but that seemed overkill as I was going to have to create a separate site for authentication, which doesn’t seem to make sense. Would the claims based authentication make sense separately though? How would you do that if it does?

Would it make more sense to just keep the username in a cookie in the traditional way and then re-query table storage with each request to get the permissions etc.? How would storing the username work in Azure?

Cost is a big factor here as it’s a very small site (by azure standards) but I want high performance for a small number of users.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If you want to run with a reasonable amount of availability you need to run your site with two instances. If you’re running with two instances you need to use a session provider that’s no the default InProc one. Your choices are:

    • AppFabric Caching (which you don’t want to use because it’s too expensive, fair enough)
    • Azure Storage Session Provider. Don’t use this. It’s an interesting experiment, but it’s only sample code, it’s slow and doesn’t cope well in production.
    • SQL Server session provider.

    If the permissions for a user weren’t going to change while they were logged in, you could just store their permissions in session. This will probably be fast enough. However this information will need to be read from SQL for each request that uses session and it is overhead.

    If you wanted to make things faster you could just store the user ID in session and load the permissions into a static dictionary (keyed on user ID) when needed. These items will need to be expired after a certain amount of time or lack of use.

    • 0