Regarding using session about outlook-dev-docs

[jasonjoh]

Yes, you can store the token in just about any way you want. The key thing is to make sure it's a secure storage.

[huchenhai]

Hi, could you please explain what the data table looks like? Should have separate table to store state, nonce and token ?

[jasonjoh]

There's no real required data format here. What I would do is store only the refresh token (not the access token ) and the user's unique ID from their ID token in long-term storage. That way you can always look up the user's refresh token and use that to obtain a fresh access token.

Access tokens are only valid for an hour so I wouldn't bother storing them in a database (and since they're usable to get at customer data, it's better to avoid storing them anyway!). I'd look at maybe keeping those in some sort of dynamic cache on your backend, again mapped to the user's ID.

State and nonce are throw-away values that aren't valid past their single use, so don't store those long-term either.

[huchenhai]

thank you so much

…

On Thu, Jun 7, 2018 at 1:34 PM, Jason Johnston ***@***.***> wrote: There's no real required data format here. What I would do is store only the refresh token (*not the access token* ) and the user's unique ID from their ID token in long-term storage. That way you can always look up the user's refresh token and use that to obtain a fresh access token. Access tokens are only valid for an hour so I wouldn't bother storing them in a database (and since they're usable to get at customer data, it's better to avoid storing them anyway!). I'd look at maybe keeping those in some sort of dynamic cache on your backend, again mapped to the user's ID. State and nonce are throw-away values that aren't valid past their single use, so don't store those long-term either. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#253 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AN_SQiaxKUGglJ_Yb3CI1dQ-eH-C-D2hks5t6WQWgaJpZM4UbIrw> .

[hshoushari]

hello, i am trying to fetch user emails from outlook to my spring project,
in my case the user is already authenticated and authorized by active directory, and the outlook account is Microsoft exchange account, and i need to fetch the user email without passing credentials because the user is already authenticated.

Kindly advice.

[shivasurya]

Do you have any advice on securely storing the refresh token in database/storage like encryption specification/types @jasonjoh

[jasonjoh]

Nothing specific. I would secure it like any other sensitive customer data. The Azure folks might have more specific guidance if you asked on Stack Overflow with the azure-authentication tag.

[huchenhai]

Hi Shivasurya, what I did was creating a token table associated with user table and stuff like refresh token and expiry time are all stored there. Saving a refresh token has nothing special, just do as a normal string. And whenever check a token, compare it's expiry time.

…

On Thu, Jan 24, 2019 at 1:23 AM s.shivasurya ***@***.***> wrote: Do you have any advice on securely storing the refresh token in database/storage like encryption specification/types — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#253 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AN_SQsIhLD4TrRGRxtBkjWpArRvl-eATks5vGVFtgaJpZM4UbIrw> .

[shivasurya]

Thank you @huchenhai , it would be better to encrypt and store.