Session cookie ITicketStore & ISecureDataFormat

[TheTrigger]

AFAIK there is no way to use ITicketStore and ISecureDataFormat with session cookie

example usage with identity cookie:

services.AddOptions<CookieAuthenticationOptions>(IdentityConstants.ApplicationScheme)
           .Configure<ITicketStore, MyCookieDataFormat>((options, store, dataFormat) =>
{
  options.TicketDataFormat = dataFormat;
  options.SessionStore = store;
  // ...
};

a similar API for the session cookie would be good

[Tratcher]

By session cookie you mean SessionOptions.Cookie? Why would you want ITicketStore and ISecureDataFormat there? https://github.com/dotnet/aspnetcore/blob/8ce579fd9a07bd595d635572005e71ebe8c4d7a2/src/Middleware/Session/src/SessionOptions.cs#L28

[TheTrigger]

Hello, no you can't do it with the CookieBuilder

It's more of a curiosity than a necessity, I tried to customize the cookie format but I found a barrier

curious that no one has ever customized cookies

[Tratcher]

The session cookie is much different, it only stores an identifier, not data, there's not much to customize.

[TheTrigger]

Yes but the identifier is generated from ITicketStore and secured by ISecureDataFormat, the result is stored on the cookie.

There is no way to use my custom implementation of those two interfaces (?)

[Tratcher]

SessionOptions is for browser sessions, not user sessions, it's not associated with auth in any way.

[dotnet-policy-service[bot]]

Looks like this PR hasn't been active for some time and the codebase could have been changed in the meantime. To make sure no conflicting changes have occurred, please rerun validation before merging. You can do this by leaving an /azp run comment here (requires commit rights), or by simply closing and reopening.

[dotnet-policy-service[bot]]

Looks like this PR hasn't been active for some time and the codebase could have been changed in the meantime. To make sure no conflicting changes have occurred, please rerun validation before merging. You can do this by leaving an /azp run comment here (requires commit rights), or by simply closing and reopening.

[mkArtakMSFT]

Thanks for contacting us. We believe that the question you've raised have been answered. If you still feel a need to continue the discussion, feel free to reopen it and add your comments.