Where do I store the Web API access token? - asp.net-mvc

Question

I have a very thin front end ASP.NET MVC 5 application that talks to a WebApi 2 back end. These are separate applications.
I have gotten the authentication token from the WebApi. I have to get it at the time that the user logs in. I store it in session state, but that is obviously the wrong place. I have situation where the user is still logged in but the auth token is no longer in session.
I need to store it along side my authentication cookie, and it needs to have the same lifespan. Why is there not an way to do this out of the box? This is a situation that thousands of programmers face, I am sure.
Here is the code where I am storing it into Session:
/// <summary>
/// Configure the application sign-in manager which is used in this application.
/// </summary>
public class ApplicationSignInManager : SignInManager<ApplicationUser, string>
{
public override async Task<SignInStatus> PasswordSignInAsync(string userName, string password, bool isPersistent, bool shouldLockout)
{
var status = await base.PasswordSignInAsync(userName, password, isPersistent, shouldLockout);
if (status == SignInStatus.Success)
await PasswordSaveTokenAsync(userName, password);
return status;
}
/// <summary>
/// Get the token from the Web API with the given user name (<paramref name="userName"/>) and password
/// (<paramref name="password"/>) and save it to the session state.
/// </summary>
/// <param name="userName">User name.</param>
/// <param name="password">Password.</param>
private async Task PasswordSaveTokenAsync(string userName, string password)
{
var baseAddress = Config.WebApiAddress;
var client = new HttpClient { BaseAddress = baseAddress };
var response = await client.PostAsync("Token", new StringContent(String.Format("grant_type=password&username={0}&password={1}", userName, password), Encoding.UTF8));
response.EnsureSuccessStatusCode();
var tokenResponse = await response.Content.ReadAsStringAsync();
var json = JObject.Parse(tokenResponse);
var token = json["access_token"].ToString();
Session.AccessToken = token;
}
}

Answer 1

Here is the solution that I cam up with.
In Global.asax:
public class MvcApplication : System.Web.HttpApplication
{
// Other members removed for brevity.
protected void Session_Start()
{
var cookie = Request.Cookies["AccessToken"];
if (cookie != null && cookie.Value != null)
Session["AccessToken"] = cookie.Value;
}
}
In ApplicationSignInManager.cs:
public class ApplicationSignInManager : SignInManager<ApplicationUser, string>
{
// Comments and other members removed for brevity.
public override async Task<SignInStatus> PasswordSignInAsync(string userName, string password, bool isPersistent, bool shouldLockout)
{
var status = await base.PasswordSignInAsync(userName, password, isPersistent, shouldLockout);
if (status == SignInStatus.Success)
await PasswordSaveTokenAsync(userName, password);
return status;
}
private async Task PasswordSaveTokenAsync(string userName, string password)
{
var baseAddress = Config.WebApiAddress;
var client = new HttpClient { BaseAddress = baseAddress };
var response = await client.PostAsync("Token", new StringContent(String.Format("grant_type=password&username={0}&password={1}", userName, password), Encoding.UTF8));
response.EnsureSuccessStatusCode();
var tokenResponse = await response.Content.ReadAsStringAsync();
var json = JObject.Parse(tokenResponse);
var token = json["access_token"].ToString();
var expires = DateTime.Parse(json[".expires"].ToString());
HttpContext.Current.Response.Cookies.Add(new HttpCookie("AccessToken")
{
Value = token,
HttpOnly = true,
Expires = expires,
});
HttpContext.Current.Session["AccessToken"] = token;
}
}

Answer 2

You could put it in a cookie also.
Be sure to mark the cookie as http only