title: What is ASP.NET Identity's IUserSecurityStampStore<TUser> interface?
body: <p>Looking at ASP.NET Identity (new membership implementation in ASP.NET), I came across this interface when implementing my own <code>UserStore</code>:</p>
  
  <pre><code>//Microsoft.AspNet.Identity.Core.dll
  
  namespace Microsoft.AspNet.Identity
  { 
      public interface IUserSecurityStampStore&lt;TUser&gt; :
      {
          // Methods
          Task&lt;string&gt; GetSecurityStampAsync(TUser user);
          Task SetSecurityStampAsync(TUser user, string stamp);
      }
  }
  </code></pre>
  
  <p><code>IUserSecurityStampStore</code> is implemented by the default <code>EntityFramework.UserStore&lt;TUser&gt;</code> which essentially get and set the <code>TUser.SecurityStamp</code> property.</p>
  
  <p>After some more digging, it appears that a <code>SecurityStamp</code> is a <code>Guid</code> that is newly generated at key points in the <code>UserManager</code> (for example, changing passwords).</p>
  
  <p>I can't really decipher much beyond this since I'm examining this code in <strong>Reflector</strong>. Almost all the symbol and async information has been optimized out.</p>
  
  <p>Also, Google hasn't been much help.</p>
  
  <h1>Questions are:</h1>
  
  <ul>
  <li>What is a <code>SecurityStamp</code> in ASP.NET Identity and what is it used for?</li>
  <li>Does the <code>SecurityStamp</code> play any role when authentication cookies are created?</li>
  <li>Are there any security ramifications or precautions that need to be taken with this? For example, don't send this value downstream to clients?</li>
  </ul>
  
  <hr>
  
  <h2>Update (9/16/2014)</h2>
  
  <p>Source code available here:</p>
  
  <ul>
  <li><a href="https://github.com/aspnet/Identity/">https://github.com/aspnet/Identity/</a></li>
  <li><a href="https://github.com/aspnet/Security/">https://github.com/aspnet/Security/</a></li>
  </ul>