Search code examples
securityidentityserver4asp.net-core-2.0

Saving access tokens (Identityserver4)


I am using IdentityServer4 with a custom user store (based on SQL Server DB). I want to know how can I store access tokens in order to check that every request have the right access token.

I tried to use the default operational store but it just saves the refresh tokens and authorization code.

Thanks in advance.


Solution

  • If I understand you correctly, you want to save access token on the server side so that you can authenticate user request. You do NOT need to store the access token on server side as IdentityServer has done this for you. If you set up your api (resource server) correctly with identity server, all you need is add [Authorize] on your api controllers (seems like that you're using .net core web api). You can find many examples on the IdentityServer docs and sample project on Github.

    In the meantime, you may need to store the access token on client side because until a token expires there is no need to authenticate the user again; this depends on which grant type you use. This is particularly true when you use ResourceOwnerPassword grant; if you client side is a SPA (e.g. Angular) then normally access token is store in the browser's local storage; for each client request, you check whether there is already a token and if so also check it hasn't expired.

    And it's possible to support refresh token for different grants so that user is auto re-authenticated when its access token expires.