Reputation: 1941
I'm using the web api 2.2 template with OWIN and Identity framework. I've purposefully set my DeafultConnection to a bad IP address yet I get no errors when stepping through and getting a bearer token and creating claims.
I can kill the w3wp.exe, start it up again and my token is still valid. So where is it getting persisted?
I am manually validating a test user in my GrantResourceOwnerCredentials() method
public class ApplicationDbContext : IdentityDbContext<ApplicationUser>
{
public ApplicationDbContext() : base("DefaultConnection", throwIfV1Schema: false)
{
}
public static ApplicationDbContext Create()
{
return new ApplicationDbContext();
}
}
Upvotes: 2
Views: 423
Reputation: 18295
I can kill the w3wp.exe, start it up again and my token is still valid. So where is it getting persisted?
OAuth tokens are not persisted at all, in the default Owin OAuth2 implementation they are stateless by design. Each token contains the claims issued for the user encrypted by the server so that only it can decrypt and validate it.
If you validate your user without hitting your database (I assume this is what you mean when you say manually inside your GrantResourceOwnerCredential
method) then of course you DbContext
never get instantiated.
Upvotes: 2