OIDC Access Token - Where to store?

Question

As we know there are three tokens involved in OpenIDConnect:

1. Access Tokens in OIDC are by default, a random unique string, not encoded using JWT.
2. ID token is encoded using JWT
3. Refresh Tokens

we usually place the ID token in the cookie in httpOnly mode.

My question is, where is the recommended storage of Access tokens? surely you need to store them in the app side.

Answer 1

You can store the tokens wherever you like, but the most common approaches are:

• Store the tokens inside the cookie. If the tokens are large, then this might be a problem because the cookies might get quite big.
• Store the tokens in a cache in memory or in a database and store a "reference" to them in the session cookie.

The ID-token usually have a very short lifetime (like 5 minutes from some providers) and it is used to create local "user" object.