I am building an asp .net mvc project and I want to save the user who is currently logged in , So I read about sessions and cookies and I found that authentication tokens stored in a cookies are a solution for the problem, So I read about them and I need to know If I am understanding this before implementing anything here What I get until now :
- After the user logs in, I generate an authentication token (using a GUID generating method)
- The generated authentication token is stored in a cookie in the client browser for .....(I don't know for how long would sound acceptable if someone can plot this thing out for me)
- The generated authentication token is stored in my database (hashed for further security using SHA256 hashing method) and corresponding to it the account id of the user and its account type (user or admin)
- I check the cookie first thing to know where the user will go to the user or the admin or even to log in page
- If the user logs out or the cookie expired and then logs in again , I generate a different token and don't use the stored one in the database (Not sure about this one)
I would really appreciate it if someone tells me if I am missing something or I am doing something wrong ?