Encrypting refresh token before storing in database via IdentityServer[.EntityFramework]

Question

Is there any way to encrypt the refresh tokens before they are stored in the database when using IdentityServer/IdentityServer.EntityFramework?

Are they already encrypted?

Answer 1

As you can see in source code, default grant storage stores hashed key.

protected virtual async Task StoreItemAsync(string key, T item, string clientId, string subjectId, DateTime created, DateTime? expiration)
        {
            key = GetHashedKey(key);

            var json = Serializer.Serialize(item);

            var grant = new PersistedGrant
            {
                Key = key,
                Type = GrantType,
                ClientId = clientId,
                SubjectId = subjectId,
                CreationTime = created,
                Expiration = expiration,
                Data = json
            };

            await Store.StoreAsync(grant);

        }

If you need encryption, you should write your own implememtation.