CODEWITHSUNDEEP
oauth-2.0openid-connect
lecarpetron dookmarion
lecarpetron dookmarion

Reputation: 711

OIDC Access Token - Where to store?

As we know there are three tokens involved in OpenIDConnect:

  1. Access Tokens in OIDC are by default, a random unique string, not encoded using JWT.
  2. ID token is encoded using JWT
  3. Refresh Tokens

we usually place the ID token in the cookie in httpOnly mode.

My question is, where is the recommended storage of Access tokens? surely you need to store them in the app side.

Upvotes: 4

Views: 3027

Answers (1)

Tore Nestenius
Tore Nestenius

Reputation: 19921

You can store the tokens wherever you like, but the most common approaches are:

  • Store the tokens inside the cookie. If the tokens are large, then this might be a problem because the cookies might get quite big.
  • Store the tokens in a cache in memory or in a database and store a "reference" to them in the session cookie.

The ID-token usually have a very short lifetime (like 5 minutes from some providers) and it is used to create local "user" object.

Upvotes: 2

Related Questions