Sessionid vs cookie authentication

Question

I am trying to figure out the pros and cons of using session based authentication based on cookie authentication

How can I verify cookie authentication

• User sends a login request sending their credentials
• Credentials are verified using a database
• Cookie will be configured with user data.
• This will be done via https and the cookies will be encrypted.
• In .net if this is the authcookie user id will be set
• The db hit only once, and subsequent calls just check the auth cookie

In the case of session-based authentication

• User sends a login request sending their credentials
• Credentials are verified using a database
• Session id is generated and also stored in db
• Cookie will be configured with user data and generated session id
• Subsequent calls compare the session identifier with the identifier in the database
• Every time db hits

Questions

Is there any reason to prefer each other? Is a cookie less reliable (even if you encrypt and sign them)? Is session performance worse as it gets into the database during every call? I saw several sites leaning in one way or another, but could not get a clear idea of ​​which approach to use. Any discussions / suggestions would be greatly appreciated.

Answer 1

It's hard for me to digest this question. To my knowledge, forms-based authentication occurs in two ways: cookies and cookieless. Cookie authentication is preferred.

In the cookie-based version, the user receives a coookie whose value is an encrypted Forms authentication ticket. The cookie is encrypted on the server. If the encryption key is not used in the machine.config file or rewritten in Web.config, the cookie can only be decrypted by the server that issued it. I believe encryption is AES, which is very secure.

In the cookieless method, the cookie payload is placed in the url using the HTTPModule. This approach applies only when the device does not support cookies (rarely). A bakery approach is not preferred - it makes AJAX more complex.

Cm:

http://msdn.microsoft.com/en-us/library/1d3t3c61.aspx

and

http://support.microsoft.com/kb/910443