3 ms·
> extracts ClaimsPrincipal So are you storing claims about the logged-in user, like what role(s) they have, in a cookie, like ASP.NET's stock authentication sy
by mwcampbell 3y ago
> extracts ClaimsPrincipal
So are you storing claims about the logged-in user, like what role(s) they have, in a cookie, like ASP.NET's stock authentication system? I almost went with ASP.NET Core for a project, but I have a problem with that approach to authentication/authorization; it leads to stale claims. I figure it's better to store only the user ID in a signed (and maybe encrypted) cookie, and read all the needed info about the user from the DB on demand. I guess I should have used ASP.NET Core but written my own auth system, or maybe used an existing third-party one if I could find one that I like.
- bob1029 3y agoYes - we are using the default AAD authentication layer over our functions, which relies on basic cookies to get the job done. The stale token thing might come up for us, but I believe we could address this in our sensitive functions by performing some kind of query to determine if the current claims are still valid.
- mwcampbell 3y agoHmm, I guess using the default AAD authentication layer is useful for outsourcing compliance as you quite reasonably want to do, and as I would like to do as well.