asp.net 中的cookie身份验证/授权的安全性如何？

问：

ASP.NET C# 中基于 Cookie 的身份验证/授权的安全性如何？看看下面的例子，不要担心密码哈希，这是一种安全/半安全的方法，还是足以防止对 Web 应用程序的攻击和利用？你会更改此代码中的任何内容吗？

public async Task<IActionResult> OnPostAsync()
    {
        var user = await _context.UsersTableTest.FirstOrDefaultAsync(u => u.UserName == Username);

        if (user != null && user.PasswordHash == Password)
        {
            var claims = new List<Claim>
        {
            new Claim(ClaimTypes.Name, user.UserName),
            new Claim("UserDepartment", user.UserDepartment) // Assuming you have a Department property in the user model
        };

            var claimsIdentity = new ClaimsIdentity(
                claims, CookieAuthenticationDefaults.AuthenticationScheme);

            var authProperties = new AuthenticationProperties
            {
                // Set additional properties if needed
            };

            await HttpContext.SignInAsync(
                CookieAuthenticationDefaults.AuthenticationScheme,
                new ClaimsPrincipal(claimsIdentity),
                authProperties);

            return RedirectToPage("/Index"); // Redirect to a protected page
        }
        else
        {
            ModelState.AddModelError("", "Invalid login attempt.");
            return Page();
        }
    }