title: Authentication ticket ( Forms authentication )
body: <p><br></p>
  
  <p>Q1 - Forms authentication module encrypts its authentication information ( ticket ) before placing it in a cookie.</p>
  
  <p>Now, little I know of encryption algorithms is that they usually use some randomly generated value to encrypt and decrypt a piece of data. Thus if same algorithm uses value A to encrypt some data, then it will also need same value in order to be able to decrypt this data. </p>
  
  <p><br></p>
  
  <p>A) Since several users could be logged on ( via Forms authentication module ) to a particular web application, will authentication information for each of these users be encrypted with the same randomly generated value? </p>
  
  <ul>
  <li>If yes, then doesn’t that represent a security risk? </li>
  </ul>
  
  <p><br></p>
  
  <ul>
  <li>If no, then when upon next request Asp.Net receives the authentication cookie ( which contains the ticket )from the user, how will it know which randomly generated value it used to encrypt the ticket ( I’m assuming it needs this same value to decrypt the ticket )</li>
  </ul>
  
  <p><br></p>
  
  <p>Q2
  Authentication ticket contains several pieces of information about the authenticated user, but which piece of these data actually tells Asp.Net ( when user again requests a page ) that it is dealing with already authenticated user? </p>
  
  <p><br></p>
  
  <p>thanx</p>