在 ASP.NET 应用程序中将身份验证令牌存储到另一个系统的位置

Question

I have an ASP.NET Web Application that serves documents to the client. This document can be in a "separate" system. To get the document from that system I need to login, then it returns a token that I then use on every request I make to it. (the credentials for that system does not depend on the current user of my Application, I just have fixed username and password)

I would like to avoid logging in every time a document is requested, instead I would prefer to store the token (it expires after an hour) internally.

What is the recommended way to store this kind of variable?

Usage of static variable is discouraged and using Session would store the ticket only for a User.

Answer 1

I think what you have is app-app authentication, not user-app authentication. In that case, how about saving token in cache with 1 hr expiry? So whenever the system tries to read the token, try getting value from cache first. If its empty - which means its first time login or expired cache - hit the auth service, get the token and save it to cache.

May be while in a load balanced environment, you might end up with each server having different tokens which I think is fine in your case. Or else you might need to consider something like Redis cache.

Answer 2

As Josh recommended in comment above, storing token in the database would be better option.

How you refresh that token is a choice you need to make.

You can request a new token just before 5 minutes the old token expires by running a service or job. And your web application will just use the new token to retrieve the documents.

Also your web application can refresh the token. Whenever it uses the token from database, it can check for the expiry and if token is expiring in next 5 minutes the application can renew/refresh the token and store the new token with new expiry in the database and use it to retrieve the documents.

If storing in database is too complex then you can consider storing token and expiry on a temporary file on the web server itself and use any of the above two approach to refresh the token. The difference will be, the token is stored in a file instead of database.