title: C# ASP.NET MVC - Storing group permissions in Owin cookie
body: <p>I am using a stateless design for a MVC5 Web API 2, ASP.NET application.</p>
  
  <p>User roles are created by administrators by selecting permissions.
  Each user in the application is assigned a custom user role, one role may be shared amongst users.</p>
  
  <p>Razor views are structured based on the permission in the users role.
  MVC and API controllers are available depending on the permissions in the users role.</p>
  
  <p>For each request to the server, the users permissions need to be processed.
  I can think of 2 ways to do this:</p>
  
  <ol>
  <li>Store the id of the users role in the Role claim and perform a database lookup to retrieve the permissions for each page-load/request.</li>
  <li>At the user login, retrieve all the permissions assigned to the users role, serialise them as JSON and store them in the Authentication claim. Then at each page-load/request, de-serialise the JSON back into objects and process the permissions.</li>
  </ol>
  
  <p>Which of these would be the better option?</p>
  
  <p>Option 1 is a lot slower than option 2.
  Is there a security risk of storing the permissions in the cookie?
  Is there a better or alternative solution which is quick and secure.</p>