app.UseCookieAuthentication - SessionStore

Question

Hi Team,

I have a scenario where in asp.net MVC application the session Key (GUID every time user logs in) is stored to a SQL database Table.

The below methods are used.
I need suggestions for two things

1.The underlying database Can have any number of fields other than Key, Ticketstring ,TicketExpiry.

is it an issue if I add more fields? As the table is handled by asp.net framework?

2.As part of session killing from external application I need to send this key to an API, but I need this key to be fetched from other places where the API calls are happening .Please suggest an approach to do it, I tried to add this key to claims and to retrieve it but the key is missing in claims when I try to fetch it

public async Task<string> StoreAsync(AuthenticationTicket ticket)
{
   string Key = Guid.NewGuid().ToString();

//inserting key,TicketString,TicketExpiry to database

   return Task.FromResult(key);

}
public Task RenewAsync(string key, AuthenticationTicket ticket) {

//inserting key,TicketString,TicketExpiry to database
}

 app.UseCookieAuthentication(new CookieAuthenticationOptions()
{
/*
 OtherProperties
*/
  SessionStore = new SqlAuthenticationSessionStore(ticketFormat,db_connectionString)
}

Answer 1

Storing the key as a claim is the correct approach. There should be no issue with adding custom claims with cookie authentication.