Where are the tokens from Open Id Connect being stored?

Question

I am using Open ID Connect and requesting tokens from Azure Active Directory. I am using the authorization code flow, so I am receiving both the id_token and the access_token. I am using .NET Core.

My configuration of Open Id Connect is as follows:

options.Authority = options.Authority + "/v2.0/";
options.TokenValidationParameters.ValidateIssuer = false;
options.ResponseType = OpenIdConnectResponseType.Code;
options.SaveTokens = true;

Notice the Save Tokens set to true

When the user is logged in, I am able to retrieve both the tokens as follows:

string accessToken = await HttpContext.GetTokenAsync("access_token");
string idToken = await HttpContext.GetTokenAsync("id_token");

My question is, where these tokens are actually being saved, and how can I configure how these tokens are being saved?

I also heard that in the authorization code flow, the identity provider will return the authorization code, and the server would then use that code to request the tokens. However, I am not doing any of that programmatically and I am still able to retrieve the tokens. Is this something handled automatically with Open Id Connect?

Answer 1

Where these tokens are actually being saved?

As the OpenID Connect protocol diagram architecture describe, When a new session is started, a new cookie is returned to control this session. This "sesion cookie" is created based on "ID Token" and as long as this cookie is valid, user will be considered as authenticated. As you are using, OpenID Connect (OIDC), it create the cookie and save token there. you could refer this docs

How can I configure how these tokens?

If you want to configure your token mechanism Microsoft provides library fro that. You can use ADAL or MSAL for your own configuration.

Is this something handled automatically with Open Id Connect?

Thought its has some background mechanism but you have to use authentication library to handle on your application code. You could refer official docs

For more details you could refer flowing docs

1. Authentication implementation
2. Authentication Libraries
3. Code sample