title: Are ASP.NET Core claims reliable and secure from tampering?
body: <p>I have several different types of users (<code>InternalUser</code>, <code>Clinician</code>, and <code>Patient</code>) that can log into my website, so, for each type of user, I've created a user class that inherits from <code>ApplicationUser</code>.</p>
  
  <p>If a logged-in user comes to the website's main page (<a href="https://example.com/" rel="nofollow noreferrer">https://example.com/</a>) then the MVC controller code needs to figure out which type of user it is so that it can return a redirect to the correct "main" page (<a href="https://example.com/clinician" rel="nofollow noreferrer">https://example.com/clinician</a>, <a href="https://example.com/patient" rel="nofollow noreferrer">https://example.com/patient</a>, etc.).</p>
  
  <p>It seems reasonable to me to use a claim as an easy, low-cost way to discriminate the user type in the controller, without having to load the current user from the database.  When I register a user, I add a claim that represents the user "type":</p>
  
  <pre><code>await _userManager.AddClaimAsync("ihi:user_type", "clinician");
  </code></pre>
  
  <p>Then, in the controller, I check the claim:</p>
  
  <pre><code>[Authorize]
  public IActionResult Index()
  {
      if (User.HasClaim("ihi:user_type", "clinician")) return Redirect("...");
      if (User.HasClaim("ihi:user_type", "patient")) return Redirect("...");
      if (User.HasClaim("ihi:user_type", "internal")) return Redirect("...");
  
      throw new InternalErrorException("Logged in user is not in a recognized user role");
  }
  </code></pre>
  
  <p>I have a couple of questions regarding this scheme:</p>
  
  <ol>
  <li>Is this a reasonable approach?</li>
  <li>This scheme (both the <code>[Authorize]</code> attribute and my claims checks) relies on looking at the value of a cookie. Is the data stored in that cookie reasonably safe from tampering? (I would hope so, otherwise an attacker could modify the cookie and game the Identity system.)</li>
  </ol>