web api身份验证后向cookie添加承载令牌

Question

public void Configure(string name, OpenIdConnectOptions options) {
                options.ClientId = _azureOptions.ClientId;
                options.Authority = _azureOptions.Authority;
                options.UseTokenLifetime = true;
                options.CallbackPath = _azureOptions.CallbackPath;
                options.RequireHttpsMetadata = false;
                options.ClientSecret = _azureOptions.ClientSecret;
                options.Resource = "https://graph.microsoft.com"; // AAD graph
                options.SaveTokens = true;
                // Without overriding the response type (which by default is id_token), the OnAuthorizationCodeReceived event is not called.
                // but instead OnTokenValidated event is called. Here we request both so that OnTokenValidated is called first which 
                // ensures that context.Principal has a non-null value when OnAuthorizeationCodeReceived is called
                options.ResponseType = "id_token code";

                // Subscribing to the OIDC events
                options.Events.OnAuthorizationCodeReceived = OnAuthorizationCodeReceived;
                //options.Events.OnAuthenticationFailed = OnAuthenticationFailed;
            }

Answer 1

承载令牌的客户端存储有两种模式:cookies和使用HTML5本地存储。

如果Cookie用于将承载令牌从客户端传输到服务器，那么Cookie也将用于在客户端存储承载令牌。

同样，如果使用授权头来传输令牌，那么必须使用HTML5本地存储（或会话存储）来存储承载令牌。

public class Startup
{
    public void Configuration(IAppBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions()
        {
            AuthenticationType = "ApplicationCookie",
            LoginPath = new PathString("/Account/Login"),
        });
    }
}