Can someone explain HttpContext.Authentication.GetTokenAsync("access_token")

Question

I have implemented an ASP.NET Core MVC Client using Hybrid flow, and I am wondering what the HttpContext.Authentication.GetTokenAsync("access_token") does.

If you need more background on my question:

The instructions for accessing an API from with an ASP.Net Core Client App Controller Action are generally as follows:

var accessToken = await HttpContext.Authentication.GetTokenAsync("access_token");
var client = new HttpClient();
client.SetBearerToken(accessToken);
var response = await client.GetAsync("http://localhost:5001/api/stuff");

There is magic in httpContext.Authentication.GetTokenAsync("access_token") :-)

I am wondering what this function might be doing. Is it decrypting the access token from a cookie in the MVC App Domain? ... from the ID4 Domain?

I am sorry but I have been unable to find sufficient documentation on what this does or finding the cookie the access token may be in. I have looked here: https://docs.microsoft.com/en-us/aspnet/core/api/microsoft.aspnetcore.authentication.authenticationtokenextensions

Does anyone know what it does? A link to more thorough documentation is a totally appreciated answer.

TU!

Answer 1

You can store arbitrary tokens in your authentication cookie in and that method simply returns one with a given name. Actually setting that would have happened during the sign in process. So in short, it comes from the authentication cookie for your client application and would typically be set at the point of sign in using IdSrv4.