I've implemented ASP.NET Core Identity for authentication in my application, and during the login process, an authentication cookie is created in the user's browser. The value of this cookie appears to be encrypted, which makes it difficult to inspect directly.

What exactly is stored in this cookie apart from the claims (such as user information and roles)?

Are there any documented cases or known methods where someone has been able to decode or extract the full content of this authentication cookie created by ASP.NET Identity in the browser?

I understand that the value is encrypted, but what components can be inferred or extracted, if any, in a typical implementation?

Additionally, is there any specific structure or data other than Claims that is stored in this cookie (e.g., expiration date, issued time, etc.)?

I've implemented ASP.NET Core Identity for authentication in my application, and during the login process, an authentication cookie is created in the user's browser. The value of this cookie appears to be encrypted, which makes it difficult to inspect directly.

What exactly is stored in this cookie apart from the claims (such as user information and roles)?

Are there any documented cases or known methods where someone has been able to decode or extract the full content of this authentication cookie created by ASP.NET Identity in the browser?

I understand that the value is encrypted, but what components can be inferred or extracted, if any, in a typical implementation?

Additionally, is there any specific structure or data other than Claims that is stored in this cookie (e.g., expiration date, issued time, etc.)?

• asp-core
• identity

• 1 Fortunately ASP.NET Core Identity is open source, so you can browse it yourself and see exactly how it's implemented. – mason Commented Feb 17 at 21:53

1 Answer 1

You could only decrypt the cookie in the server machine because of the protection key. After login, switching to this "privacy" page would log the cookie content. (expiration date, issued time are included).

public IActionResult Privacy()
{
    var cookie = Request.Cookies[".AspNetCore.Identity.Application"];
    var dataProtector = HttpContext.RequestServices
        .GetRequiredService<IDataProtectionProvider>()
        .CreateProtector("Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware", "Identity.Application", "v2"); 
            
    byte[] protectedData = Base64UrlTextEncoder.Decode(cookie);
    byte[] unprotectedData = dataProtector.Unprotect(protectedData);

    string decryptedText = Encoding.UTF8.GetString(unprotectedData);
    Console.WriteLine("Decrypted Cookie Data:");
    Console.WriteLine(decryptedText);
    return View();
}