I am building an asp .net mvc project and I want to save the user who is currently logged in , So I read about sessions and cookies and I found that authentication tokens stored in a cookies are a solution for the problem, So I read about them and I need to know If I am understanding this before implementing anything here What I get until now :

  1. After the user logs in, I generate an authentication token (using a GUID generating method)
  2. The generated authentication token is stored in a cookie in the client browser for .....(I don't know for how long would sound acceptable if someone can plot this thing out for me)
  3. The generated authentication token is stored in my database (hashed for further security using SHA256 hashing method) and corresponding to it the account id of the user and its account type (user or admin)
  4. I check the cookie first thing to know where the user will go to the user or the admin or even to log in page
  5. If the user logs out or the cookie expired and then logs in again , I generate a different token and don't use the stored one in the database (Not sure about this one)

I would really appreciate it if someone tells me if I am missing something or I am doing something wrong ?

2 Answers 2


Instead of reinventing the wheel, use a library or framework that handles authentication/session management. There are many common pitfalls that you may encounter otherwise.

For example, your authentication token generation doesn't sound ideal. Consider using tools provided with ASP.NET such as SessionIDManager.

Also, when the user logs out, it is usually best to invalidate the session completely. In this case, this would mean deleting the token from your database, and generating a new one next time the user logs in.

For guidance, follow the appropriate OWASP Cheat Sheet closely.


I would not allow persistent admin logins with cookies because the administrator could browse a site with malicious javascript and get his cookies stolen. I would force a password check at each new admin login. The cookie could obviously maintain the session once he has authenticated but the method outlined above looks to be insecure.

  • Thanks for plotting that, I will force the admin to log in after every session but what about the normal user , Will the method outlined above be secure ? Jun 20, 2020 at 15:54
  • "the administrator could browse a site with malicious javascript and get his cookies stolen" how do you envision this working? Jun 20, 2020 at 17:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .