title: Claims Cookie Security in ASP.Net Identity
body: <p>The way I understood it from reading all over the net, is that Claims get stored as cookie,  now I add User's Roles to the Claims collection and thus it will be saved into the Claims Cookie. Now this is  great as it would save me the round tripping to Database to retrieve user role each time I have Authorization Attribute to check against in my <code>ASP MVC</code> Controller.</p>
  
  <ul>
  <li>Is this secure? </li>
  <li>Can the cookie be decrypted if stolen?</li>
  <li>Is there an alternative not save Claims in Cookie and save it on
  server and is this efficient, or am I worried to much?</li>
  </ul>