Persist user security profile data at custom Claims

Question

My application have to fetch data from external services with the usage of manually provided at profile/management by user api key & api secret.

I'd like to prevent a huge amount of retriving those necessary keys queries to database and persist it somewhere else (assuming that those keys won't be updated too frequently).

From my point of view it could be implemented with next options:

1. Use MemoryCache provider with SlidingExpiration;
2. Create a custom Claim and append it into existing Identity claims collection;

Please correct me if I'm wrong, but if I've realized it right - claim's information is a part of data, which is used for serialization/deserialization at frontend<->backend interaction (I'm not quite confident about it, but suppose that it's used within cookies & tokens).

Actually these keys are also required for a several background processes (message queue consumers or scheduled jobs for example).

Would you mind letting me know a proper way for persiting such protected and frequently used fields in an optimized way?

Thank you in advance.

Answer 1

When you login using one of SignInManager's sign-in methods, it sets a cookie on the browser with an access token in it. This cookie contains claims data. So in subsequent authorized requests, you can query the User.Claims field to access the required fields without making a trip to your datastore.

Now whether you choose to use claims or not totally depends on how often you need the API Key / Secret. Your claims are part of the access token. If sending the API key / Secret on every request is justified, claims is the ideal choice.

---

UPDATE:

Rather than decrypting the tokens at the frontend, it's better to send them to the frontend client along with the access token.

Incase you're not aware of IdentityServer4 or OpenIddict do check them out. It's probably got all that you need.