Setting new access_token in current HttpContext session

Helloes. I'm implementing a token provider with Identity Server 4 and want to have my Client application to user Refresh Tokens.

With the following code, I can successfully request a new pair of access_token and refresh_token and correctly invoke the API

public async Task<IActionResult> CallApiUsingUserRefreshToken()
{
   var oldAccessToken = await HttpContext.GetTokenAsync("access_token");
   var oldRefreshToken = await HttpContext.GetTokenAsync("refresh_token");

   var tokenClient = new TokenClient("http://localhost:5000/connect/token", "mvc", "secret");
   var newToken = await tokenClient.RequestRefreshTokenAsync(oldRefreshToken);

   var client = new HttpClient();
   client.SetBearerToken(newToken.AccessToken);
   var content = await client.GetStringAsync("http://localhost:5001/identity");

   ViewBag.Json = JArray.Parse(content).ToString();
   return View("json");
}

Now the question is, how do I store this new pair in my session cookie? So next time I come to this method I use await HttpContext.GetTokenAsync("access_token") I get my latest token

Example

First request to `CallApiUsingUserRefreshToken()`

old access_token eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5YTA1ZDE5NTZiNjM1YTI5OTRkN2Q4MmUzOTVlZDNlIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTAxNTA4ODIsImV4cCI6MTUxMDE1MDkxMiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJhcGkxIl0sImNsaWVudF9pZCI6Im12YyIsInN1YiI6IjY2MzQyOWUzLTIwNTYtNDg1OC1iN2RhLThmYjhiMDI4YTEyZiIsImF1dGhfdGltZSI6MTUxMDE1MDg4MCwiaWRwIjoibG9jYWwiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiYXBpMSIsIm9mZmxpbmVfYWNjZXNzIl0sImFtciI6WyJwd2QiXX0.JJ4LhrEY05Z0CMKp9V81ur2ufZZSCmE2M0ACKsfqIMrq84eFg2IHu5RlbL7Tn4nD6TQj-6aLvhmJ0RunFOp4t1Sx-Qq_tgAsue5d5hEMZH-Xk-gdf5wR94uNJX1imMSDsqD4C_IOiebeoAHHxGj39vHQvvQrZMeKsX1_o7h5XteCBfB51PclYycBZsu5iDV-EbbQaXCSjNlmWifYyCN52pwDeLcKLJp6rjEy765SJ50C8Zymuwjj7PHgvway_Sr5W0F-oNkUO-wqy60sFPaK3D62KuUpSIKVUUh4B164jkpUY0NiJefDAHogVTcSBsRbeJj6m6oiBGzKxx5JCCBB2g

old refresh_token 981eb24796cf0bf191f0845cb82a708420683de3bc5f7e4c07859287587bc43c

new access_token eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5YTA1ZDE5NTZiNjM1YTI5OTRkN2Q4MmUzOTVlZDNlIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTAxNTMwMDUsImV4cCI6MTUxMDE1MzAzNSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJhcGkxIl0sImNsaWVudF9pZCI6Im12YyIsInN1YiI6IjY2MzQyOWUzLTIwNTYtNDg1OC1iN2RhLThmYjhiMDI4YTEyZiIsImF1dGhfdGltZSI6MTUxMDE1MDg4MCwiaWRwIjoibG9jYWwiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiYXBpMSIsIm9mZmxpbmVfYWNjZXNzIl0sImFtciI6WyJwd2QiXX0.N3cKXJSgLip_6TP-c9WIJsR6vsOMthBr7ORgio02KUQe1C6KqF1dBCGTm7T43LY9UpRPFGRMj5o4Wf2NyAkd7PkmHAJio4dh-1L0ivNuXbLo7jbfC5svhN4FszmDQPBMS_uidXRXZ5Cqe47TD-kTgMWGijXkXmPRXYu_rA181tbM8uPWJZtDlagQ_exFC1ZS_0gaNzJ7b6_d7eGV5tI6o31VBZXoPIwA1mT56hL-UO9PvEKs6RhGCAfelo0KKKrZ8eNeozTNPzXwCUYYyW3fsUmuKL8rtDqJIPiyH9gyzxWZeG0xkGlozSsgvPLtLvuA7nB0sqtko7Kpgl_8ECXKRQ

new refres_token 19a81ad1d0a4ef9ebe31a84b2313a1e8c372a3cfb1d2a482e13112576ab5c03a

Second request to `CallApiUsingUserRefreshToken()`

old refresh_token 981eb24796cf0bf191f0845cb82a708420683de3bc5f7e4c07859287587bc43c

new access_token eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5YTA1ZDE5NTZiNjM1YTI5OTRkN2Q4MmUzOTVlZDNlIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTAxNTMwMTQsImV4cCI6MTUxMDE1MzA0NCwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJhcGkxIl0sImNsaWVudF9pZCI6Im12YyIsInN1YiI6IjY2MzQyOWUzLTIwNTYtNDg1OC1iN2RhLThmYjhiMDI4YTEyZiIsImF1dGhfdGltZSI6MTUxMDE1MDg4MCwiaWRwIjoibG9jYWwiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiYXBpMSIsIm9mZmxpbmVfYWNjZXNzIl0sImFtciI6WyJwd2QiXX0.AMV5DblN48MxvWm4qbMNcAgGYTYGb0Rz-LAMX2-jAGtQhkis8tauWfpugm0aU_tCbwn6ktUQN1UepBCLpVe9qAo1hC4E_YDrhqxEKCrJK3NhWEYloNMAxFUJVak2rRO81gjH7zHZ-HvdxZaSzG2CGpkKOZKbnCuPSkXbUr_dgAulKH7Ul2hunqH9dCbX-BE9X7-ZjO6cXm8tZHOdRJBm7NsEvVo1bbSaTx4uEX0HDEX01uQAiUx6fz2j4Exp5A9CdlQhkqH4h5hSP3D3XvtH9wpRpD-kWlMRMxSwXeJ7P0OQMn04WOM-sGFXQFfUHwKxvSuMxcOx1MzUJF5-1W-kfg

new refres_token 9b0130de391db80b5b7499f18297b84af79a4f6ef423fdd85fb4e7f487611562

I'm looking how to set the new access_token and refresh_token from the first request to be then used in the second one.

Solution

Eventually figured it out.

For anyone wanting to update their current tokens inside the .Net Authentication Cookie, you should use the TokenStore provided in the Microsoft Authentication package

var auth = await HttpContext.AuthenticateAsync("Cookies");
auth.Properties.StoreTokens(new List<AuthenticationToken>()
{
    new AuthenticationToken()
    {
        Name = OpenIdConnectParameterNames.AccessToken,
        Value = newToken.AccessToken
    },
    new AuthenticationToken()
    {
        Name = OpenIdConnectParameterNames.RefreshToken,
        Value = newToken.RefreshToken
    }
});

await HttpContext.SignInAsync(auth.Principal, auth.Properties);

This will override both access_token and refres_token in the session, when doing the HttpContext.SignInAsync, this is for .Net Core 2.0

Setting new access_token in current HttpContext session

Example

First request to CallApiUsingUserRefreshToken()

Second request to CallApiUsingUserRefreshToken()

First request to `CallApiUsingUserRefreshToken()`

Second request to `CallApiUsingUserRefreshToken()`