ASP.Net Store user password in cookie session?

Question

I know that the membership provider stores the username and expiration time in an encrypted cookie, and then uses it to verify that the user is still logged in for the session.

Is it possible to save the user password in this encrypted cookie. If so, how do you access the server side?

I need the username and password to be accessible on the server side, because I need to call web services that use the same credentials. Is there a better way to do this?

Answer 1

You must keep it in a session state that never leaves the server.

You should also try to change these web services to use authentication tickets instead of passwords (e.g. OAuth), because it is never recommended to store passwords in plain text.

Answer 2

Yes you can do it. You pass the encoded information to the userData field of the FormsAuthenticationTicket constructor:

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(version, name, issueDate, expirationDate, isPersistent, yourEncodedData); string secureTicket = FormsAuthentication.Encrypt(ticket); Response.Cookies.Add( new HttpCookie(FormsAuthentication.FormsCookieName, secureTicket)); 

Ideally, this should be done over an SSL connection, and the cookie should be marked with both HttpOnly and Secure attributes.

Then, to get the value:

 FormsIdentity id = (FormsIdentity)User.Identity; FormsAuthenticationTicket ticket = id.Ticket; string yourEncodedInfo = ticket.UserData; 

You can also simply set up your own cookie, separate from the auth ticket form.

However, storing the password directly in the cookie, even if it is encrypted, is not a good idea from a security point of view. Use session state instead:

 Session["password"] = password; 

Session state also uses a cookie, but the cookie itself contains only the key. The server uses the key to obtain a dictionary of key / value pairs unique to this session that remain on the server (or serialized in the database, depending on how it is configured).

Answer 3

Not recommended, but you can use FormsAuthenticationTicket.UserData .