Shrinking the ASP.NET Core auth cookie with ITicketStore

Cookie authentication in ASP.NET Core serializes the whole AuthenticationTicket into the cookie, so large claim sets can push it past WAF limits. Implementing ITicketStore keeps the ticket on the server and leaves only a session key in the cookie. The article compares an in-memory store with a distributed cache version and discusses the scaling and revocation trade-offs.

Key points

• ITicketStore has four methods: StoreAsync, RenewAsync, RetrieveAsync and RemoveAsync.
• The store is attached via CookieAuthenticationOptions.SessionStore, resolved from DI with an options Configure call.
• An in-memory store works only on a single instance and signs everyone out on restart.
• For scaled-out apps, IDistributedCache with TicketSerializer.Default keeps tickets in a shared cache such as Redis.
• Server-side tickets allow revoking sessions by removing the key, at the cost of a lookup per request.

A team testing a new WAF saw requests blocked before reaching their servers. The culprit was cookie size: by default, ASP.NET Core cookie authentication packs the whole ticket, claims included, into the cookie, so richer identities mean bigger cookies.

ITicketStore, set through CookieAuthenticationOptions.SessionStore, offers the fix: the ticket stays on the server and the cookie holds only a key. It starts with an IMemoryCache version, which fails across multiple instances and loses sessions on restart, then moves to a distributed cache using TicketSerializer. That cache now holds user claims and tokens, so it needs restricted access and encryption. Each request then needs a lookup, but sessions can be revoked by deleting their key.

Real-world use

• An enterprise app with many roles and claims must keep its cookie under a WAF size limit.
• A web app running on several Azure Container Apps replicas shares sessions through Redis.
• An internal portal where admins must be able to end a user's session immediately.

Why it matters

If your cookies grow with claims or saved tokens, moving the ticket server-side keeps them small and makes sessions revocable. The cost is a cache that every request and every sign-in depends on.

Related stories

• Using the ADFS userinfo endpoint instead of allatclaimsBWBart Wullems (The Art of Simplicity)Oct 19
• A secure enterprise chat with React, .NET 10 and Microsoft FoundryDVDEV Community: #dotnet1 d ago
• ASP.NET Core Authentication & Authorization Explained: What to Use, When, and How to Ship It SafelyDVDEV Community: #aspnetcore1 d ago