title: Asp.net MVC Is it safe to keep sensitive info in Session?
body: <p>I have a basic Authentication system on my Asp.net MVC Website</p>
  
  <pre><code>[HttpPost]
  public ActionResult Login(LoginViewModel model, string returnUrl)
  {
      WebSecurity.Login(model.UserName, model.Password, persistCookie: false)
  
      return RedirectToAction("Index", "Home");
  }
  </code></pre>
  
  <p>I also have a <code>UserInfoViewModel</code> class where i keep some user specific information, and i use it on different pages.</p>
  
  <p>To avoid creating the <code>UserInfoViewModel</code> every time i need it, i want to save it in Session on Login method.</p>
  
  <pre><code>public ActionResult Login(LoginViewModel model, string returnUrl)
  {
     WebSecurity.Login(model.UserName, model.Password, persistCookie: false)
     var userInfoViewModel = new UserInfoViewModel();
     Session["userInfo"] = userInfoViewModel;
  
      return RedirectToLocal(returnUrl);
  }
  </code></pre>
  
  <p>Considering that i have sensitive information that i rely on inside <code>UserInfoViewModel</code>, like <code>IsSuperuser</code>, is it safe to keep that object in Session? Will it expire when the user login session expires as well?</p>
  
  <p><strong>SOLUTION</strong></p>
  
  <p><code>System.Security.Principal.IIdentity</code> is exacly made for that. It saves inside AUTH cookie custom user information you need, so you don't recalculate it every time.</p>
  
  <p><a href="http://www.asp.net/web-forms/videos/authentication/use-custom-principal-objects" rel="nofollow">Use Custom Principal Objects video turorial</a></p>
  
  <p>Thank you for answers!</p>