I'm learning identityserver4 and can't understand some stuff.
Shortly: I want to authorize end-users with email and password on ASP.NET MVC client side (it will send user credentials to the token server to get tokens), and I don't want third-party clients to retrieve data from my API resources.
As I understood from the documentation:
implicit flow is used for SPA (js clients) and uses id_token to authorize users. I can store id_token in my browser.
client credentials flow is used for trusted apps (like ASP.NET MVC client) to authorize clients and uses
access_code
. I can storeaccess_code
inside my app.
So looks like I need a hybrid flow.
In the documentation I read that I need to use AddOpenIdConnect()
method and
Technically the tokens are stored inside the properties section of the cookie.
So my questions:
If the
id_token
can be stored in the browser, why is it not safe to store theaccess_token
there too ?As the docs state, the tokens are stored inside the properties section of the cookie. It's confusing, because some guides says, that it's not safe to store
access_token
there. So where I should store access token in my ASP.NET MVC client?Am I right, that
AddOpenIdConnect()
configures my ASP.NET MVC app to retrieveaccess_token
automatically from the token server? And if yes - in which moment should I authorize users with email/password and how to combine all tokens inside one JWT on my ASP.NET MVC client's backend when I will send requests to api resources ?