title: how secure is the Ticket.UserData in User.Identity in asp.net
body: <p>My website uses ASP.NET's forms authentication and i am inserting user specific information into the UserData portion of the authentication ticket/cookie. Since the UserData is inside the authentication ticket it is encrypted like so</p>
  <pre><code>authCookie.Value = FormsAuthentication.Encrypt(newTicket);
  </code></pre>
  <p>Now I am not too worried about the data being compromised at this point since it's encrypted. but i noticed that the data is available in unencrypted form like this</p>
  <pre><code>FormsIdentity fid = User.Identity as FormsIdentity;
  string plainTextUserData = fid.Ticket.UserData;
  </code></pre>
  <p>The data itself is not too important. i am still ok even if other people can see it. but i cannot allow people to hijack this information and start using it as their own. for example, i don't want one user to be logged in pretending to be a different user (based on the userID contained in UserData</p>
  <p>Is this something I have to worry about?</p>
  <h3>Edit 1:</h3>
  <p>The reason i want to do this is so i can stop using sessions and just use cookies and Ticket.UserData</p>
  <h3>Edit 2:</h3>
  <p>The data in Ticket.UserData is not changing. it's constant once the user is logged in.</p>