title: .net mvc authentication cookies & sessions
body: <p>net mvc 5 application using entity frame work etc and am new to .net c# etc (used to php &amp; sessions) </p>
  
  <p>so i have read allot about using .nets authentication service and that is some how registers a user upon login using FormsAuthentication.SetAuthCookie. </p>
  
  <p>however i need to authenticate a user group for example admin or moderator. and from what i understand this can be achieved and be set using [authenticate(roles="admin")].</p>
  
  <p>but surely if this is using a set cookie a user if they knew how could just change their registered role from user to admin to access restricted content?</p>
  
  <p>so in as simple terms as possible how does .net mvc ensure security in authenticating users? can i use sessions instead of cookies? do i need to create my own authentication system.? </p>
  
  <p>i have searched and read all i can find and most resources just explain how cookies work or how to implement authentication using cookies but very little about sessions. </p>