Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Where to store tokens in a xamarin.form application

I have the class below that will be used in a xamarin.forms mobile application to retrieve the token generated by OAuth(webapi). Once this is generated I need to store in a place where I can access it again and not generating this all the time. Where is the best place to store this in the Pcl? I will also want to be able to remove this once the user logs off.

        class LoginService
        {
            public async Task Login(string username, string password)
            {
                HttpWebRequest request = new HttpWebRequest(new Uri(String.Format("{0}Token", Constants.BaseAddress)));
                request.Method = "POST";

                string postString = String.Format("username={0}&password={1}&grant_type=password", 
                HttpUtility.HtmlEncode(username), HttpUtility.HtmlEncode(password));
                byte[] bytes = Encoding.UTF8.GetBytes(postString);
                using (Stream requestStream = await request.GetRequestStreamAsync())
                {
                    requestStream.Write(bytes, 0, bytes.Length);
                }

                try
                {
                    HttpWebResponse httpResponse =  (HttpWebResponse)(await request.GetResponseAsync());
                    string json;
                    using (Stream responseStream = httpResponse.GetResponseStream())
                    {
                        json = new StreamReader(responseStream).ReadToEnd();
                    }
                    TokenResponseModel tokenResponse = JsonConvert.DeserializeObject(json);
                    return tokenResponse.AccessToken;
                }
                catch (Exception ex)
                {
                    throw new SecurityException("Bad credentials", ex);
                }
            }
        }
like image 350
Baba Avatar asked Sep 01 '17 16:09

Baba


People also ask

Where is the best place to store tokens?

If any of the third-party scripts you include in your page is compromised, it can access all your users' tokens. To keep them secure, you should always store JWTs inside an httpOnly cookie. This is a special kind of cookie that's only sent in HTTP requests to the server.

Where should API tokens be stored?

Tokens are stored under Manage Tokens module in ServiceNow, when you call the rest API in the script you can simply set the header and the token by doing a query in the manage tokens table.

Where should bearer tokens be stored?

Should you keep tokens in cookies or in local storage? There are two patterns for client-side storage of bearer tokens: cookies and using HTML5 local storage. If cookies are being used to transmit the bearer token from client to server, then cookies would also be used to store the bearer token on the client side.

Where do you store Auth0 tokens?

Auth0 recommends storing tokens in browser memory as the most secure option. Using Web Workers to handle the transmission and storage of tokens is the best way to protect the tokens, as Web Workers run in a separate global scope than the rest of the application.


1 Answers

Just an update for anyone searching, as things have changed since this post was created. It is not advised to use the following any more:

Application.Current.Properties

To securely store things like access tokens etc you can use the Xamarin.Essentials SecureStorage static class.

Just add the Xamarin.Essentials nuget package if you don't already have it and use it like so:

using Xamarin.Essentials;
.
.
.

await SecureStorage.SetAsync("someKey", "someValue");

var myValue = await SecureStorage.GetAsync("someKey");

you also have the option to

SecureStorage.Remove("someKey");
//or 
SecureStorage.RemoveAll();

Refer this for more documentation

like image 178
Craig Avatar answered Sep 20 '22 19:09

Craig