What is cookie bloat in ASP.NET Core and how does ITicketStore fix it?

Cookie bloat occurs when a serialized identity payload grows large because of claims, roles, group memberships, or permission metadata. ITicketStore fixes this by storing the full AuthenticationTicket in a server-side repository such as NCache and sending only a lightweight session key to the browser.

How does NCache handle ITicketStore sliding expiration?

When ASP.NET Core cookie authentication renews a ticket through ITicketStore.RenewAsync, the NCache-backed store updates the ticket in the cache and refreshes the corresponding cache entry expiration.

ASP.NET Core ITicketStore with NCache

Q: Why use NCache as an ASP.NET Core ITicketStore provider?

NCache provides an out-of-process, distributed cache cluster for authentication tickets. This allows authenticated sessions to remain available across load-balanced application instances without relying on sticky sessions.

In ASP.NET Core, cookie authentication is the standard mechanism used to manage user sessions. By default, when a user logs in, the framework serializes their entire identity including claims, roles, security stamps, and authentication metadata into an AuthenticationTicket. This ticket is encrypted, base64-encoded, and sent back to the browser as a cookie payload.

As applications grow, claims profiles (structured collections of digital identity attributes issued by an authentication authority) often expand to include deep enterprise metadata, group memberships, and permission flags. This leads to cookie bloat, where the HTTP request header grows excessively large, causing network overhead or getting rejected by web servers due to size limits.

The ITicketStore interface solves this by shifting the authentication session state from the client to a server-side repository. When implemented, the full AuthenticationTicket payload is externalized to a backend store, and only a lightweight, unique reference token (a session key) is sent to the client browser inside the cookie.

Important

ITicketStore is supported in NCache OSS 5.3.6.2 and later and NCache Enterprise 5.3.7 and later.

Why Use NCache as an ASP.NET Core ITicketStore Provider?

While a simple in-memory repository (like MemoryCacheTicketStore) works for a standalone instance, it fails in enterprise environments. In-memory data is volatile and tied to a single machine, meaning server restarts log out all active users, and load-balanced environments require complex sticky session setups.

Using NCache as the distributed backend for your ITicketStore bridges this gap by providing an out-of-process, highly available cache cluster. It offers several architectural advantages:

Elimination of Sticky Sessions: Since all load-balanced web app instances communicate with the same NCache cluster, a user can hit any server node on subsequent requests and remain seamlessly authenticated.
Resilience and High Availability: NCache's clustered topologies (such as Partitioned-Replica) ensure that session tickets are duplicated across multiple nodes. If a caching server goes down, sessions are not lost.
Linear Scalability: As the volume of active concurrent users grows, you can dynamically add nodes to the NCache cluster to handle the increased transaction throughput without degrading authentication performance.

Key Features

Integrating NCache as your server-side session backend yields critical performance and operational features:

Cookie Minimization: Reduces the authentication cookie to a fixed, minimal size (a unique string key), ensuring optimal HTTP request header performance.
Enhanced Session Security: Keeps sensitive user claims graphs within your secure, server-side data infrastructure rather than transmitting them back and forth over the wire to the client browser.
Dynamic Session Invalidation: Provides the ability to instantly terminate a user's session globally across the entire web farm by programmatically evicting their key from the NCache cluster (e.g., during forced password resets or administrative lockouts).
Native Serialization Compatibility: Integrates smoothly with ASP.NET Core’s native binary TicketSerializer, safely handling complex object graphs inside ClaimsPrincipal that can be difficult to handle with text-based JSON serializers.
Flexible Expiration Synchronization: Inherits NCache’s advanced TTL (Time-to-Live) mechanisms, allowing the distributed cluster to automatically synchronize absolute or sliding eviction windows with the cookie middleware's configuration.

How TicketStore Works with NCache

The ITicketStore integration acts as a mediator between the ASP.NET Core authentication middleware and the NCache cluster APIs. The transactional lifecycle maps out through four fundamental operations:

Client Sign-In (Write Operation): When a user authenticates successfully through the application's login logic, HttpContext.SignInAsync() is triggered. The ASP.NET Core cookie middleware creates an AuthenticationTicket, but instead of writing the complete ticket into the browser cookie, it calls ITicketStore.StoreAsync(ticket).

The custom store then creates a unique, namespaced session key, such as NCacheAuthTicket:{key}, serializes the authentication ticket into a binary payload using the framework's native TicketSerializer, and stores it in the NCache cluster through direct cache client operations such as _cache.Insert. The generated session key is then sent back to the browser inside a lightweight cookie.

Subsequent Requests (Read Operation): For every subsequent HTTP request to a protected endpoint, the browser sends the session key cookie. The cookie middleware extracts the session key and passes it to ITicketStore.RetrieveAsync(key).

The store uses the key to retrieve the corresponding ticket data from the NCache cluster through a direct cache read operation such as _cache.Get. If a matching cache entry is found, the binary payload is deserialized back into an AuthenticationTicket, which restores the user's ClaimsPrincipal on HttpContext.User. If the ticket is missing because of expiration, eviction, or manual removal, the store returns null, and the middleware treats the user as unauthenticated and follows the configured authentication challenge behavior.

Sliding Expiration (Renew Operation): If the application is configured to use sliding expiration, the renewal process depends on active requests passing through the ASP.NET Core cookie middleware. As long as requests continue to flow through the application, such as through normal user activity or a /ping endpoint, the middleware evaluates whether the sliding expiration renewal threshold has been reached.

When renewal is required, the middleware invokes ITicketStore.RenewAsync(key, ticket) with the updated authentication ticket. The store updates the ticket information in NCache and refreshes the corresponding cache entry, resetting the TTL window on the cluster nodes so the authenticated session remains active.

Client Sign-Out (Remove Operation): When a user signs out, the application triggers HttpContext.SignOutAsync(). The cookie middleware then calls ITicketStore.RemoveAsync(key) to remove the server-side authentication ticket associated with the session key.

The store sends a remove operation, such as _cache.Remove, to the NCache cluster. This deletes the authentication ticket from the distributed cache, making the authenticated identity unavailable across all application instances that rely on the same NCache-backed TicketStore.

In This Section

NCache as ITicketStore Provider
Learn how to set up the prerequisites, implement the custom ITicketStore SDK architecture, and register the provider in your application.