User.Identity.GetUserId() 可以被用户伪造吗？

Question

Can User.Identity.GetUserId() be faked by a user? Or is it safe to assume that it will always return an UserId for which an user exists or null?

Answer 1

With ASP.Net Identity, those details are claims that are encrypted by the web server, and stored in a cookie.

How secure is it? That's something that's too broad and opinion based to get into here, but this may hold some relevance: How secure is ASP.NET Identity session cookie?

Suffice to say that it would not be a trivial exercise for a user to send a fake user id.

Answer 2

Found something helpful related to your question. How to get current user, and how to use User class in MVC5?