Geek Answers Handbook

Twitter Oauth with ASP.NET MVC, where to keep a secret token

I have a dilemma where to store secret tokens that I get from Twitter.

Options:

a. Put it in a FormsAuthenticationTicket, encrypt it and put it in a cookie. How safe is this?

b. Put it in Session and put the username in FormsAuthentciation.

FormsAuthentication.SetAuthCookie(String.Concat("<em>", screen_name, "</em>"), true);

This way, I will need to check if secret cookies exist in the first session.

with. Store secret cookies in the database and store your username in cookies such as b.

Which one do you recommend and why?

Thanks a lot!

+4
source share
2 answers

Since the token does not expire, and your application is considered authorized for this user account, you need to keep the token in that lasts longer than the session.

In this case, I would save it in the database associated with the username.

+3
source

I would not prefer to store the "username" with the token, because the username is actually the name of the screen that you get through xml, and it's easy to change.

Why not save the "user id" with the token?

0
source

More articles:


All Articles