Question

I’m using Forms authentication in ASP.NET MVC website and I store user account login name in AuthCookie like this:

FormsAuthentication.SetAuthCookie(account.Login, false);

I want to ask if there is a possibility that user on client side will somehow manage to change his login name in AuthCookie and thus he will be for example impersonated as someone with higher privileges and authorized to do more actions than he is normally supposed to have. Also is it better to save in this cookie user account login name or user account ID number?

Answer 1

Cookies are encrypted so chances for that a quite slim. But still.

More than one property approach

If you’d like to make your security even tighter you could save username as well as user ID or some other data that can’t be guessed from the username. The combination of these makes it safer because if you can guess one it harder to guess others and use the correct combination of them. Ie. If you guess other user’s email/username it’s a bit harder to guess the same user’s ID, because they’re not related. So the more unrelated properties you combine the more steps it takes to get the right combination.

Logon security token approach

You could use an alternative approach described in this scenario:

1. User logs in.
2. Generate a random security logon token that can be of random length with some minimum length defined and save it against user in the data store. This is probably not a problem while it’s quite common that other data is stored at logons as well like LastLogonDate info.
3. Use this token and save it in the cookie instead of usernames or other info.
4. If user logs-out, clear logon security token from the data store
5. User logs in again… go back to 1 and create a new token again and use it in this session.

This way it will make it safer on the long run, because this information will change on each login and if user does manually logout you can always clear that token from the store, so it won’t at all be possible to inject someone else’s identity. This does make it a but more complicated to use permanent cookies though but it can still be done.

This approach is not bullet proof but it provides additional security level that prevents the same attack over and over again when one account has been compromised. And also when one account is compromised it doesn’t mean that others can be as well. If your security tokens are long enough it would be much harder to start a brute force attack on your site and while this kind of attack would be executed security tokens will change so it is definitely safer.