title: User roles - why not store in session?
body: <p>I'm porting an ASP.NET application to MVC and need to store two items relating to an authenitcated user: a list of roles and a list of visible item IDs, to determine what the user can or cannot see.  </p>
  
  <p>We've used WSE with a web service in the past and this made things unbelievably complex and impossible to debug properly.  Now we're ditching the web service I was looking foward to drastically simplifying the solution simply to store these things in the session.  A colleague suggested using the roles and membership providers but on looking into this I've found a number of problems:</p>
  
  <p>a) It suffers from similar but different problems to WSE in that it has to be used in a very constrained way maing it tricky even to write tests;</p>
  
  <p>b) The only caching option for the RolesProvider is based on cookies which we've rejected on security grounds;</p>
  
  <p>c) It introduces no end of complications and extra unwanted baggage;</p>
  
  <p>All we want to do, in a nutshell, is store two string variables in a user's session or something equivalent in a secure way and refer to them when we need to.  What seems to be a ten minute job has so far taken several days of investigation and to compound the problem we have now discovered that session IDs can apparently be faked, see </p>
  
  <p><a href="http://blogs.sans.org/appsecstreetfighter/2009/06/14/session-attacks-and-aspnet-part-1/" rel="noreferrer">http://blogs.sans.org/appsecstreetfighter/2009/06/14/session-attacks-and-aspnet-part-1/</a></p>
  
  <p>I'm left thinking there is no easy way to do this very simple job, but I find that impossible to believe.</p>
  
  <p>Could anyone:</p>
  
  <p>a) provide simple information on how to make ASP.NET MVC sessions secure as I always believed they were?  </p>
  
  <p>b) suggest another simple way to store these two string variables for a logged in user's roles etc. without having to replace one complex nightmare with another as described above?</p>
  
  <p>Thank you.</p>