我应该依靠User.Identity值吗？

Question

I am interested in security connected with ASP.NET applications. When I am developing my websites I extensively use User.Identity.Name value to identify user. I am wondering if there is a possibility to modify request so that client could change this value and become other user. If so how to identify users then and how to distinguish superuser safely?

Answer 1

Yes, you can rely on this value. The whole security of ASP.NET relies on it. It is stored in an encrypted cookie that can only be decrypted by the application. If a malicious user tries to substitute the value of this cookie with another username he will not be able to encrypt the cookie because he doesn't have the machine keys.