How do I store an OWIN OAuth 2 access_token in an HttpOnly Secure cookie?

Question

My primary goal is to properly secure a series of Web API controllers. Thus far, I have used OWIN to generate access_tokens and tested the functionality by decorating a class with [Authorize], then calling it with jQuery ajax calls containing a Bearer token in the header. It seems the right path, but I've read local storage is not secure. Rather, a cookie marked as HttpOnly and Secure seems the favored solution.

I've been able to find mentions that people are utilizing local storage, and even a walk through:

https://learn.microsoft.com/en-us/aspnet/web-api/overview/security/individual-accounts-in-web-api

What I have not been able to find is how to configure OWIN to use cookies to store tokens.

Gary Archer · Answer 1 · 2020-08-25T20:48:28.623

SERVER SIDE ARCHITECTURE

The OWIN stack will tie you to cookie based security and works like this. It may be that this is a perfect fit for your requirements:

Web UI makes an Ajax call to a web back end and implicitly sends an auth cookie
Web UI is limited to calling a web back end in the same domain
Web back end gets access token from cookie
Web back end forwards the access token to an API in a different domain
API validates access token

A common approach is demonstrated in this thread, where tokens are included in the auth cookie, and the web back end unpacks cookies from tokens.

var id = new ClaimsIdentity(n.AuthenticationTicket.Identity.AuthenticationType);

id.AddClaim(new Claim("access_token", tokenResponse.AccessToken));
id.AddClaim(new Claim("refresh_token", tokenResponse.RefreshToken));
id.AddClaim(new Claim("id_token", n.ProtocolMessage.IdToken));

REQUIREMENTS?

I would always recommend starting with goals / requirements rather than technology from vendors such as Microsoft, which is often a little old or suboptimal.

CLIENT SIDE ARCHITECTURE

If you want to do more on the client side, then an alternative approach is to use an SPA architecture and do more in Javascript:

Use a library such as oidc-client
Send access tokens directly to cross domain APIs
Consider storing tokens only in browser memory rather than in local storage

If interested in this approach in terms of your future planning, then these 2 posts of mine are a good starting point:

Anyway, if any of this is useful, feel free to post follow up questions.

How do I store an OWIN OAuth 2 access_token in an HttpOnly Secure cookie?

1 Answers1