title: Dealing with long bearer tokens from webapi by providing a surrogate token
body: <p>I am building a web api using ASP.NET WebApi 2 using claims authentication, and my users can have very large number of claims. With a large number of claims the bearer token grows very large quickly, so I am attempting to find a way of returning a much shorter bearer token.</p>
  
  <p>SO far I have discovered that I can provide a <code>IAuthenticationTokenProvider</code> to the OAuth options <code>OAuthAuthorizationServerOptions.AccessTokenProvider</code> property:</p>
  
  <pre><code>OAuthOptions = new OAuthAuthorizationServerOptions
  {
      TokenEndpointPath = new PathString("/Token"),
      Provider = new ApplicationOAuthProvider(PublicClientId),
      AccessTokenExpireTimeSpan = TimeSpan.FromHours(12),
      AccessTokenProvider = new GuidProvider() // &lt;-- here
  };
  </code></pre>
  
  <p>And this gives me a chance to intercept the <code>AuthenticationTicket</code> and stash it away, replacing it with something simpler - in my example below a hashed guid. (Note: At the moment this class simply holds a <code>ConcurrentDictionary&lt;string,AuthenticationTicket&gt;</code> with my sessions - in a real-world example I intend to store the sessions in some persistent storage)</p>
  
  <pre><code>public class GuidProvider : IAuthenticationTokenProvider
  {
      private static ConcurrentDictionary&lt;string, AuthenticationTicket&gt; tokens 
          = new ConcurrentDictionary&lt;string, AuthenticationTicket&gt;();
  
      public void Create(AuthenticationTokenCreateContext context)
      {
          throw new NotImplementedException();
      }
  
      public async System.Threading.Tasks.Task CreateAsync(AuthenticationTokenCreateContext context)
      {
          var guid = Guid.NewGuid().ToString();
  
          var ticket = Crypto.Hash(guid);
  
          tokens.TryAdd(ticket, context.Ticket);
  
          context.SetToken(ticket);
      }
  
      public void Receive(AuthenticationTokenReceiveContext context)
      {
          throw new NotImplementedException();
      }
  
      public async System.Threading.Tasks.Task ReceiveAsync(AuthenticationTokenReceiveContext context)
      {
          AuthenticationTicket ticket;
  
          if (tokens.TryGetValue(context.Token, out ticket))
          {
              if (ticket.Properties.ExpiresUtc.Value &lt; DateTime.UtcNow)
              {
                  tokens.TryRemove(context.Token, out ticket);
              }
              context.SetTicket(ticket);
          }
      }
  }
  </code></pre>
  
  <p>So my questions:</p>
  
  <ul>
  <li>Is this an appropriate (and secure!) way of providing a surrogate key in place of my long claims-generated token?</li>
  <li>Is there perhaps a better/easier place where I should be doing this within the webapi/OAuth stack? </li>
  </ul>
  
  <p>Another thing to note is that I intend to support refresh tokens, and in fact the example above was pulled from examples which use this sort of mechanism for the Refresh token - except with a refresh token they appear to be single-use, so the  <code>ReceiveAsync</code> method would usually always remove the refresh token supplied from the <code>ConcurrentDictionary</code>, I'm not entirely sure I understand why?</p>