Access token from cookie about identityserver3.accesstokenvalidation HOT 5 CLOSED

no

from identityserver3.accesstokenvalidation.

Well - to qualify that - it supports the standard Katana extensibility to read the token from wherever you like.

from identityserver3.accesstokenvalidation.

Tokens as cookies sounds wrong to me btw

from identityserver3.accesstokenvalidation.

Thanks for the clarification.

As for the reason why I'm considering putting the token in a cookie (we're currently placing it in the Authorization header), then it is twofold:

a) We want to allow users to download files via our API. The links should not be open to anyone, both because we want to control who can download what, and also because we want to track who has downloaded what. Downloading files via Ajax seems to be troublesome on older browsers, so the ability to expose links to our API directly seems to be a better option. This of course means that we cannot manipulate the HTTP headers for those links on the client side, i.e. we cannot add the Authorization header before the user clicks the link. I'm aware of the option to use query string tokens, but this also seems dirty to me (what if the users start sending download links to each other? What will the user experience be when the tokens are expired when the user clicks the link? Etc.)

b) I would like to ensure that 3rd party tools and macros (such as in Excel) written by users will have access to our API. The easiest option for that seems to be to use cookies, but please correct me if I'm wrong.

We would of course take measures to avoid CSRF (there are some methods outlined here: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/).

Again, I'm simply trying to get the big picture of what seems the best option. Any arguments for or against cookies would be most welcome :-)

Daníel

from identityserver3.accesstokenvalidation.

OK - if you are fully aware of the gotchas (mostly CSRF) then cookies are acceptable.

I am not aware of a CSRF protection though that would work without headers.

from identityserver3.accesstokenvalidation.