.NET 6 Web API中存储结构化信息至Cookie的最佳实践及相关文档咨询

Hey there! I totally get the frustration with outdated docs when you're new to .NET—let's walk through the right way to store structured user data in cookies for your .NET 6 Web API.

First: Serialize Structured Data to Strings #

Cookies only store string values, so to save structured data (like a user object), you'll need to serialize it to a string first. .NET 6 comes with System.Text.Json built-in, which is perfect for this.

Example steps:

• Define a class for your user data:

  public class UserSessionData
  {
      public int UserId { get; set; }
      public string Username { get; set; }
      public DateTime LastLogin { get; set; }
  }
  

• Serialize the object to a JSON string when setting the cookie:

  var userData = new UserSessionData
  {
      UserId = 123,
      Username = "johndoe",
      LastLogin = DateTime.UtcNow
  };
  
  string serializedData = JsonSerializer.Serialize(userData);
  Response.Cookies.Append("UserSession", serializedData, new CookieOptions
  {
      // We'll cover these critical options next!
      HttpOnly = true,
      Secure = true,
      SameSite = SameSiteMode.Strict,
      Expires = DateTime.UtcNow.AddDays(7)
  });
  

Using CookieOptions for Security & Control #

The CookieOptions parameter in Response.Cookies.Append() is non-negotiable for following security best practices:

• HttpOnly: Blocks client-side JavaScript from accessing the cookie, protecting against XSS attacks.
• Secure: Ensures the cookie is only sent over HTTPS—always enable this in production.
• SameSite: Controls cross-site cookie delivery; use SameSiteMode.Strict or SameSiteMode.Lax to mitigate CSRF risks.
• Expires: Sets the cookie's validity window; use DateTime.UtcNow to avoid timezone-related expiration bugs.

Simplifying with CookieBuilder #

If you want consistent cookie settings across your entire API, use CookieBuilder to define reusable rules in Program.cs:

builder.Services.Configure<CookiePolicyOptions>(options =>
{
    options.MinimumSameSitePolicy = SameSiteMode.Strict;
    options.Secure = CookieSecurePolicy.Always;
});

// Define a named cookie configuration
builder.Services.Configure<CookieAuthenticationOptions>("UserSessionCookie", options =>
{
    options.Cookie.Name = "UserSession";
    options.Cookie.HttpOnly = true;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.ExpireTimeSpan = TimeSpan.FromDays(7);
});

Then inject the preconfigured options into your controller to reuse settings:

private readonly CookieAuthenticationOptions _sessionCookieOptions;

public UserController(IOptions<CookieAuthenticationOptions> sessionCookieOptions)
{
    _sessionCookieOptions = sessionCookieOptions.Value;
}

// In your action method
Response.Cookies.Append("UserSession", serializedData, _sessionCookieOptions.Cookie);

Reading the Structured Data Back #

To retrieve and deserialize the cookie data:

if (Request.Cookies.TryGetValue("UserSession", out string serializedData))
{
    var userData = JsonSerializer.Deserialize<UserSessionData>(serializedData);
    // Use the deserialized user data as needed
}

Key Best Practices to Follow #

• Skip sensitive data: Even with HttpOnly, cookies can be intercepted in edge cases. Never store passwords, tokens, or sensitive PII here.
• Keep cookies lean: Browsers enforce size limits (usually ~4KB), so avoid overloading cookies with unnecessary data.
• Validate deserialized data: Add checks to ensure the deserialized object hasn't been tampered with—consider adding a cryptographic signature if data integrity is critical.

内容的提问来源于stack exchange，提问作者Vetle Hofsøy-Woie