First of all let me apologize if what I am asking here does not make much sense. Also, thank you for your time. This is my first time righting in here so I hope I do it right.
I have been developing in Asp.Net for a year now, and we used the Session to keep the user data persistent throughout that user session (Like Email, Name, Phone, Company, etc..). And if I'm not mistaken that information was hidden, there for not in a cookie and not visible in the browser.
Now we are starting do develop in .Net Core 3.1 and I'm in charged of recreate the login using this new framework, with the condition that the persistent user data is not stored in a cookie or not visible to the browser, it needs to be safe and hidden.
I have looked in the .Net Core Session and the Auth Cookie, but for both of those options we create cookies that hold all that information in, in both this approaches is the information secure or is vulnerable?
After a while I came across this area in the Microsoft docs: Introduction to Identity on ASP.NET Core
My question is if I go with this approach can I accomplish what I want, have persistent user data not in a cookie or not visible to the browser. If what I'm try to accomplish is not possible and a cookie needs to be used, is there a way of keeping that data save and secure? Or is there another approach to keeping data across the session secure and not visible to the browser?
EDIT:
To give a more practical example, in our dashboard we will filter the data depending on the user, more precisely his type, Company, Area and Channel, this are attributes of every user. When a user logs in and is redirected to the Dashboard he will only see the data that as the same attributes as him. In Asp .Net all I needed to do was save that information in the moment of login inside the Session and then retrieve it when I needed them.
In .Net Core, I have been able to it in 2 different ways, the first was to use the "HttpContext.Session.SetString()" and "HttpContext.Session.GetString()" to save and retrieve the data I needed. The second way was to pass the data inside the Claims when I do "HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(claimsIdentity), authenticationProperties);". Both of this approaches allows me to fetch the information I need and use it. But all the data is inside cookies, visible in the browser.
But For what I'm understanding .Net Core does not allow to save data like that on server-side, so is possible to encrypt the auth cookie so the data stays protected.
My code to login the user is as Follow:
After I authenticate the user I run this to login the user and create the auth cookie.
string userGUID = Guid.NewGuid().ToString();
List<Claim> claims = new List<Claim>()
{
new Claim(ClaimTypes.NameIdentifier, userGUID),
new Claim(ClaimTypes.Role, "Admin"),
new Claim("Company", "User Company"),
new Claim("Area", "User Area"),
new Claim("Channel", "User Channel")
};
if (claims != null && claims.Count > 0)
{
var claimsIdentity = new ClaimsIdentity(
claims, CookieAuthenticationDefaults.AuthenticationScheme);
AuthenticationProperties authenticationProperties = new AuthenticationProperties
{
IsPersistent = false,
AllowRefresh = false,
ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(30)
};
_httpContextAccessor.HttpContext.SignInAsync(
CookieAuthenticationDefaults.AuthenticationScheme,
new ClaimsPrincipal(claimsIdentity),
authenticationProperties);
}
Once again thank you for your time and please tell me if there is something that I can do to clarify this question.
