I am using the Azure AD authentication provider for the asp.net web application and I wish to add extra role claims (based on custom application logic, those cannot be provided from Azure AD).

Something like described here:


I am using the following code in the startup.cs:

services.Configure<OpenIdConnectOptions>(AzureADDefaults.OpenIdScheme, options =>
    options.Events = new OpenIdConnectEvents
        OnTokenValidated = context => SetupExtraRoles(context.Principal)

static Task SetupExtraRoles(ClaimsPrincipal principal)
    IEnumerable<Claim> extraRoles = GenerateExtraRoleClaims();
    ClaimsIdentity extraIdentity = new ClaimsIdentity(roleClaims);
    return Task.CompletedTask;

This works just fine - when user is logged in and token is received, the identity is extended with the extra role claims.

Also, I have noticed that later on I am getting back extra role claims whenever user requests other pages or refreshes the current page - which is also great.

So my question is - Where are user identity claims stored later on, between the requests - Cookie? Server memory? Session?

Can user tamper these identity claims if they are stored in Cookie and elevate the permissions by manually injecting the role claims?


Identity claims are stored in cookies, which are then encrypted. While I suppose there is a possibility that the cookies could be tampered with to alter the claim, I think this is unlikely. However, even if this were to happen, the claim is presented to the server for validation, and if the user's claim is not valid, then they will be rejected. This will prevent the restricted resource from being accessed. Remember that a claim is exactly what it sounds like: a user's claim. Without validating this claim, there would be no security. Below are additional links to information that you may find helpful with your research:



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.