Twitter Oauth with ASP.NET MVC, where to store secret token

I have a dilemma where to store secret tokens that I receive from twitter.


a. Put it into FormsAuthenticationTicket, encrypt it and put it into cookie. Is this secure enough?

b. Put it into Session and put user_name into FormsAuthentciation

FormsAuthentication.SetAuthCookie(String.Concat("<em>", screen_name, "</em>"), true);

That way I'd have to check if secret cookies exist in session first.

c. Store secret cookies in the database and store username in cookies like b.

Which one do you recommend and why?

Thanks a lot!

13.10.2009 22:59:47

Since the token does not expire and your application is considered authorized for that user account, you need to store the token in something that lasts longer than a session.

In that case, I would store it in a database associated with the username.

13.10.2009 23:19:50
I agree. Store in database with username, token, and token secret.
Ryan Alford 14.10.2009 03:43:42

I would not prefer storing 'username' with token, because user name is actually the screen name you get through xml, and one can easily change it.

Why not to store 'user id' with the token?

12.12.2009 21:02:41