How to persist DotNetOpenAuth OAuth2 refresh and access tokens
I have been working with the IAuthorizationState (AuthorizationState) and
the WebServerClient and I am trying to figure out the right way of
persisting the authorization state information such that on retrieval the
framework can make an optimal decision on what call needs to be made to
get the access token I need for a web service call. I find that while the
basic workflow is backed by multiple good samples out there, the right way
of persisting the tokens could benefit from additional guidelines.
Assuming I am starting from scratch and have no tokens persisted in the DB
yet (or any other medium for that matter), I go through the following
steps: 1. WebServerClient.PrepareRequestUserAuthorization - user is sent
off to google. The url contains the offline parameter for a refresh token
2. I get the code parameter back (authorization code) from google and call
ProcessUserAuthorization to get the AccessToken and RefreshToken along
with the expiration dates
If I now want to persist that, should I persist the entire object so the
dates are persisted as well or will the two tokens be enough?
When a user performs another action that needs the authorization state
information, I can now do a DB lookup to retrieve the token. Do I always
need to call the RefreshAuthorization method after I have retrieved the
tokens or should i perform my own logic to see if the dates are past their
expiration (assuming i persisted those too)?
I finally see that the IAuthorizationState interface contains SaveChanges
method that isn't implemented on the AuthorizationState default
implementation. Is that the recommended way of persisting the object by
creating your own class and providing an implementation of this method for
how to persist the entire object/tokens?
No comments:
Post a Comment