Where to store Access Token after Web API Authentication?

Question

Where to store Access Token after Web API Authentication?

Kevin Azure 141

I am having 2 application components:

Web API protected with JWT
WEB APPLICATION WEB APPLICATION authenticates user with login page (username, password) to the WEB API and gets the Access-token & Refresh-token.

Where do I store the Access-token?

[so that everytime WEB APPLICATION user will send this access token, I can transfer same to WEB API]

Cookie?

Please advice.

Lan Huang-MSFT 30,186 Reputation points Microsoft External Staff

2023-03-15T03:09:14.2633333+00:00

Hi @Kevin Azure,

I think you can try using FormsAuthentication.RedirectFromLoginPage Method.

https://learn.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.redirectfromloginpage?redirectedfrom=MSDN&view=netframework-4.8.1

public static void RedirectFromLoginPage (string userName, bool createPersistentCookie);

createPersistentCookie Boolean

true to create a durable cookie (one that is saved across browser sessions); otherwise, false.

When you use CORS and send the authentication cookie to your WebApi, the WebApi doesn't care whether the authentication is from an old "Remember me" cookie or from a fresh login. All it cares about is that the cookie value passed in the Authorization header is valid.
Kevin Azure 141 Reputation points

2023-03-15T13:35:06.4133333+00:00
Thanks @Lan Huang-MSFT

Since I already have Access Token & Refresh Token: Can you validate my below approach too?

Store the Access Token as Cookie for the WEBAPP

Store the Refresh Token to Database

Use Request Interceptor to check Cookie for every requests

If Cookie is expiring - Use Refresh Token to generate new Access Token - Replace the Cookie

If Refresh Token also expired - Remove Cookie - Redirect user to Login Page
Kevin Azure 141 Reputation points

2023-03-17T01:55:17.1866667+00:00

@Lan Huang-MSFT please advice
Lan Huang-MSFT 30,186 Reputation points Microsoft External Staff

2023-03-17T03:22:07.6833333+00:00

Hi @Kevin Azure,

Can you validate my below approach too?

I don't know how to help you verify your method, I don't even have your project.

Do you want to know if these methods are feasible?

Based on these methods, I can only provide posts that may be helpful to you.

Store the Access Token as Cookie for the WEBAPP

You don't know how to store?

You can check out this post on where to properly and securely store JWT tokens in web-based applications and this post on storing access and refresh tokens in cookies

Store the Refresh Token to Database

Why should I store Refresh Token for JWT in the server database? Would storing access token instead be better?

https://stackoverflow.com/a/40117262

If Refresh Token also expired - Remove Cookie - Redirect user to Login Page

https://stackoverflow.com/questions/52175302/handling-expired-refresh-tokens-in-asp-net-core

Your answer

Lan Huang-MSFT 30,186 Reputation points Microsoft External Staff

2023-03-15T03:09:14.2633333+00:00

Hi @Kevin Azure,

I think you can try using FormsAuthentication.RedirectFromLoginPage Method.

https://learn.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.redirectfromloginpage?redirectedfrom=MSDN&view=netframework-4.8.1

public static void RedirectFromLoginPage (string userName, bool createPersistentCookie);

createPersistentCookie Boolean

true to create a durable cookie (one that is saved across browser sessions); otherwise, false.

When you use CORS and send the authentication cookie to your WebApi, the WebApi doesn't care whether the authentication is from an old "Remember me" cookie or from a fresh login. All it cares about is that the cookie value passed in the Authorization header is valid.
Kevin Azure 141 Reputation points

2023-03-15T13:35:06.4133333+00:00

Thanks @Lan Huang-MSFT

Since I already have Access Token & Refresh Token: Can you validate my below approach too?

Store the Access Token as Cookie for the WEBAPP

Store the Refresh Token to Database

Use Request Interceptor to check Cookie for every requests

If Cookie is expiring - Use Refresh Token to generate new Access Token - Replace the Cookie

If Refresh Token also expired - Remove Cookie - Redirect user to Login Page
Kevin Azure 141 Reputation points

2023-03-17T01:55:17.1866667+00:00

@Lan Huang-MSFT please advice
Lan Huang-MSFT 30,186 Reputation points Microsoft External Staff

2023-03-17T03:22:07.6833333+00:00

Hi @Kevin Azure,

Can you validate my below approach too?

I don't know how to help you verify your method, I don't even have your project.

Do you want to know if these methods are feasible?

Based on these methods, I can only provide posts that may be helpful to you.

Store the Access Token as Cookie for the WEBAPP

You don't know how to store?

You can check out this post on where to properly and securely store JWT tokens in web-based applications and this post on storing access and refresh tokens in cookies

Store the Refresh Token to Database

Why should I store Refresh Token for JWT in the server database? Would storing access token instead be better?

https://stackoverflow.com/a/40117262

If Refresh Token also expired - Remove Cookie - Redirect user to Login Page

https://stackoverflow.com/questions/52175302/handling-expired-refresh-tokens-in-asp-net-core

Share via

Where to store Access Token after Web API Authentication?

Your answer