Identity cookie authentication in ASP.NET MVC

Question

I have the following problem: I'm using Identity in ASP MVC application. My authentication type is "ApplicationCookie". The problem is that this application is going to be used by a bank and they forbid cookies. My question is (I'm new to ASP) where is this cookie stores (on the server only, on the client. etc.) and is Identity the right approach in this scenario?

Thank you.

Rahul Nikate · Accepted Answer · 2015-12-03 11:29:43Z

2

The first thing ApplicationCookie will get stored in client browser itself. If you have configured Cookie Authentication then Server returns cookie containing encrypted and signed claims to the browser. This cookie will be stored in your browser until it expire or user signs out which deletes the cookie. By default 14 days is the expiry time for this cookie. This cookie is by default named: .AspNet.ApplicationCookie.

This is a potential security risk and to provide a truly secure connection you would have to use HTTPS.

edited Dec 3, 2015 at 11:29

answered Dec 3, 2015 at 11:17

Rahul Nikate

6,3555 gold badges45 silver badges57 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Identity cookie authentication in ASP.NET MVC

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related