Possible to use Token instead of Cookie? about session

[brockallen]

"Session" in this repo means session state -- a cookie-based server-side state management mechanism for UI apps. This is unrelated to authentication.

[ankitbko]

I get that. I wanted to know in case the session is established by another service, is there is a way to pass session Id as token in header?
@brockallen We have Identity server 3 for authentication and authorization with angular being client. I was just thinking, is it a good practise to use auth token as session token for the user?

[brockallen]

Well, in general I think session state is a bad idea: http://brockallen.com/2012/04/07/think-twice-about-using-session-state/. And even more so for Web APIs. So I'd not design a web app or a web api to use session state.

[Tratcher]

The use of cookies is baked into the middleware: https://github.com/aspnet/Session/blob/dev/src/Microsoft.AspNet.Session/SessionMiddleware.cs#L77.

[ankitbko]

@brockallen I had read your blog long ago :). I completely agree with you about avoiding session state and maintaining user specific data in relational/NoSQL database. We are using Redis as NoSQL and caching solution. ASP.NET 5 session also uses RedisCache as IDistributedCache for session management. Moreover now the sessions are non-locking which essentially solves one of the biggest performance issues with ASP Sessions. This basically means that whatever I store in Session gets stored as cache objects in Redis.

I still avoid Session as much as possible, but it looks to be fine to be used for non critical short lived user data, as you get out of the box way to store and retrieve objects with expiration built in. All long lived user data will be stored in more reliable manner in database.
My current thought is to use token returned by Ids3 as session token. There is really no need to maintain another token in cookie just for accessing session.

@Tratcher Thanks. I had gone through the code yesterday itself. It seems with small modification I can just switch to get session key from token. Still an option to switch to custom key or overridable method would have been better. Thanks for pointing me to right direction.

[John0King]

@Tratcher Session ID use cookie is not a good idea. specifically when a browser disable cookies or not support httponly