Search code examples
node.jsbotframeworkfacebook-messenger

Where should I store access token

I am currently working on a chatbot for Facebook Messenger. I am working with the Microsoft bot framework and the code is written in node.js.

I am interacting with a database through an api. With every request I have to pass an access token inside the request header. I have read on the internet that you would usually store such a token inside a cookie or web storage. However I also found out that you can't do that on Facebook Messenger. I was thinking about storing the access token inside a variable, but my concern is that this might not be secure. Is there any other secure way to store the access token?

I am fairly new to node.js and it is my first time working with tokens. Help is much appreciated.

Solution

  • You can use session.userData to hold your database token. If you are concerned about it being secure, then encrypted it before saving.

    session.userData.dbtoken = encryptToken(token);

    The token can later be retrieved and used when you need it:

    var token = decryptToken(session.userData.dbtoken);
var databaseData = getUserDataFromDatabase(token);

    https://docs.botframework.com/en-us/core-concepts/userdata/

    Or, use a local database like NeDB: https://github.com/louischatriot/nedb This would be the most secure option, since the database would reside on your server.