Why is the session cookie encrypted in .NET Core?

Question

SessionMiddleware in .Net Core 3.1 uses IDataProtector to encrypt a randomly generated session-key.

The session-key is a reference to a collection of items stored in a cache, which are available through ISession.

The source code is here:

• https://github.com/dotnet/aspnetcore/blob/master/src/Middleware/Session/src/SessionMiddleware.cs

The relevant bit is between rows 91 and 96.

There is plenty of documentation for setting up IDataProtection, but why is the session-key encrypted in the first place? The cookie is designed to be transported securely between client and server. The actual session-data stored in the cache is not encrypted. Encrypting a randomly generated key seems superfluous and requires developers to set up IDataProtection for seemingly little value (if you didn't need it for something else already).

Answer 1

Found the issue where IDataProtection was added.

https://github.com/aspnet/Session/issues/105

The encrypted key is much longer than the originally used guid, making it more secure I guess.