In my case I went with the first option, as it represented the easiest (and most efficient) way to incorporate the information into the existing authentication workflow.
I think your answer will really depend on the nature of the extra properties you are wanting to store.
- Storing them in a cookie could be problematic if the information changes frequently AND you have a lengthy cookie expiration period. In this case you may want to implement some logic for expiring a cookie.
- Using the session would be require you to refresh the properties you are storing when a request comes in following a session timeout - this is likely to occur more frequently than a cookie expiration.
- A Database request on each
Application_PostAuthenticateRequest
could prove inefficient depending on traffic, though doing so would ensure you always had the most recent data.