Setting new access_token in current HttpContext session

Question

Helloes. I'm implementing a token provider with Identity Server 4 and want to have my Client application to user Refresh Tokens.

With the following code, I can successfully request a new pair of access_token and refresh_token and correctly invoke the API

public async Task<IActionResult> CallApiUsingUserRefreshToken()
{
   var oldAccessToken = await HttpContext.GetTokenAsync("access_token");
   var oldRefreshToken = await HttpContext.GetTokenAsync("refresh_token");

   var tokenClient = new TokenClient("http://localhost:5000/connect/token", "mvc", "secret");
   var newToken = await tokenClient.RequestRefreshTokenAsync(oldRefreshToken);

   var client = new HttpClient();
   client.SetBearerToken(newToken.AccessToken);
   var content = await client.GetStringAsync("http://localhost:5001/identity");

   ViewBag.Json = JArray.Parse(content).ToString();
   return View("json");
}

Now the question is, how do I store this new pair in my session cookie? So next time I come to this method I use await HttpContext.GetTokenAsync("access_token") I get my latest token

---

Example

First request to CallApiUsingUserRefreshToken()

old access_token eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5YTA1ZDE5NTZiNjM1YTI5OTRkN2Q4MmUzOTVlZDNlIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTAxNTA4ODIsImV4cCI6MTUxMDE1MDkxMiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJhcGkxIl0sImNsaWVudF9pZCI6Im12YyIsInN1YiI6IjY2MzQyOWUzLTIwNTYtNDg1OC1iN2RhLThmYjhiMDI4YTEyZiIsImF1dGhfdGltZSI6MTUxMDE1MDg4MCwiaWRwIjoibG9jYWwiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiYXBpMSIsIm9mZmxpbmVfYWNjZXNzIl0sImFtciI6WyJwd2QiXX0.JJ4LhrEY05Z0CMKp9V81ur2ufZZSCmE2M0ACKsfqIMrq84eFg2IHu5RlbL7Tn4nD6TQj-6aLvhmJ0RunFOp4t1Sx-Qq_tgAsue5d5hEMZH-Xk-gdf5wR94uNJX1imMSDsqD4C_IOiebeoAHHxGj39vHQvvQrZMeKsX1_o7h5XteCBfB51PclYycBZsu5iDV-EbbQaXCSjNlmWifYyCN52pwDeLcKLJp6rjEy765SJ50C8Zymuwjj7PHgvway_Sr5W0F-oNkUO-wqy60sFPaK3D62KuUpSIKVUUh4B164jkpUY0NiJefDAHogVTcSBsRbeJj6m6oiBGzKxx5JCCBB2g

old refresh_token 981eb24796cf0bf191f0845cb82a708420683de3bc5f7e4c07859287587bc43c

new access_token eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5YTA1ZDE5NTZiNjM1YTI5OTRkN2Q4MmUzOTVlZDNlIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTAxNTMwMDUsImV4cCI6MTUxMDE1MzAzNSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJhcGkxIl0sImNsaWVudF9pZCI6Im12YyIsInN1YiI6IjY2MzQyOWUzLTIwNTYtNDg1OC1iN2RhLThmYjhiMDI4YTEyZiIsImF1dGhfdGltZSI6MTUxMDE1MDg4MCwiaWRwIjoibG9jYWwiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiYXBpMSIsIm9mZmxpbmVfYWNjZXNzIl0sImFtciI6WyJwd2QiXX0.N3cKXJSgLip_6TP-c9WIJsR6vsOMthBr7ORgio02KUQe1C6KqF1dBCGTm7T43LY9UpRPFGRMj5o4Wf2NyAkd7PkmHAJio4dh-1L0ivNuXbLo7jbfC5svhN4FszmDQPBMS_uidXRXZ5Cqe47TD-kTgMWGijXkXmPRXYu_rA181tbM8uPWJZtDlagQ_exFC1ZS_0gaNzJ7b6_d7eGV5tI6o31VBZXoPIwA1mT56hL-UO9PvEKs6RhGCAfelo0KKKrZ8eNeozTNPzXwCUYYyW3fsUmuKL8rtDqJIPiyH9gyzxWZeG0xkGlozSsgvPLtLvuA7nB0sqtko7Kpgl_8ECXKRQ

new refres_token 19a81ad1d0a4ef9ebe31a84b2313a1e8c372a3cfb1d2a482e13112576ab5c03a

Second request to CallApiUsingUserRefreshToken()

old access_token eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5YTA1ZDE5NTZiNjM1YTI5OTRkN2Q4MmUzOTVlZDNlIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTAxNTA4ODIsImV4cCI6MTUxMDE1MDkxMiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJhcGkxIl0sImNsaWVudF9pZCI6Im12YyIsInN1YiI6IjY2MzQyOWUzLTIwNTYtNDg1OC1iN2RhLThmYjhiMDI4YTEyZiIsImF1dGhfdGltZSI6MTUxMDE1MDg4MCwiaWRwIjoibG9jYWwiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiYXBpMSIsIm9mZmxpbmVfYWNjZXNzIl0sImFtciI6WyJwd2QiXX0.JJ4LhrEY05Z0CMKp9V81ur2ufZZSCmE2M0ACKsfqIMrq84eFg2IHu5RlbL7Tn4nD6TQj-6aLvhmJ0RunFOp4t1Sx-Qq_tgAsue5d5hEMZH-Xk-gdf5wR94uNJX1imMSDsqD4C_IOiebeoAHHxGj39vHQvvQrZMeKsX1_o7h5XteCBfB51PclYycBZsu5iDV-EbbQaXCSjNlmWifYyCN52pwDeLcKLJp6rjEy765SJ50C8Zymuwjj7PHgvway_Sr5W0F-oNkUO-wqy60sFPaK3D62KuUpSIKVUUh4B164jkpUY0NiJefDAHogVTcSBsRbeJj6m6oiBGzKxx5JCCBB2g

old refresh_token 981eb24796cf0bf191f0845cb82a708420683de3bc5f7e4c07859287587bc43c

new access_token eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5YTA1ZDE5NTZiNjM1YTI5OTRkN2Q4MmUzOTVlZDNlIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTAxNTMwMTQsImV4cCI6MTUxMDE1MzA0NCwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJhcGkxIl0sImNsaWVudF9pZCI6Im12YyIsInN1YiI6IjY2MzQyOWUzLTIwNTYtNDg1OC1iN2RhLThmYjhiMDI4YTEyZiIsImF1dGhfdGltZSI6MTUxMDE1MDg4MCwiaWRwIjoibG9jYWwiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiYXBpMSIsIm9mZmxpbmVfYWNjZXNzIl0sImFtciI6WyJwd2QiXX0.AMV5DblN48MxvWm4qbMNcAgGYTYGb0Rz-LAMX2-jAGtQhkis8tauWfpugm0aU_tCbwn6ktUQN1UepBCLpVe9qAo1hC4E_YDrhqxEKCrJK3NhWEYloNMAxFUJVak2rRO81gjH7zHZ-HvdxZaSzG2CGpkKOZKbnCuPSkXbUr_dgAulKH7Ul2hunqH9dCbX-BE9X7-ZjO6cXm8tZHOdRJBm7NsEvVo1bbSaTx4uEX0HDEX01uQAiUx6fz2j4Exp5A9CdlQhkqH4h5hSP3D3XvtH9wpRpD-kWlMRMxSwXeJ7P0OQMn04WOM-sGFXQFfUHwKxvSuMxcOx1MzUJF5-1W-kfg

new refres_token 9b0130de391db80b5b7499f18297b84af79a4f6ef423fdd85fb4e7f487611562

I'm looking how to set the new access_token and refresh_token from the first request to be then used in the second one.

Answer 1

Eventually figured it out.

For anyone wanting to update their current tokens inside the .Net Authentication Cookie, you should use the TokenStore provided in the Microsoft Authentication package

var auth = await HttpContext.AuthenticateAsync("Cookies");
auth.Properties.StoreTokens(new List<AuthenticationToken>()
{
    new AuthenticationToken()
    {
        Name = OpenIdConnectParameterNames.AccessToken,
        Value = newToken.AccessToken
    },
    new AuthenticationToken()
    {
        Name = OpenIdConnectParameterNames.RefreshToken,
        Value = newToken.RefreshToken
    }
});

await HttpContext.SignInAsync(auth.Principal, auth.Properties);

This will override both access_token and refres_token in the session, when doing the HttpContext.SignInAsync, this is for .Net Core 2.0