title: Securing an OAuth / OpenID Connect identity in a cookie for easy login
body: <p>I have a website that uses Azure Active Directory or Google+ for logging in. I go through an OAuth2 login flow, and the users email along with their tokens are returned to me by their identity service.</p>
  
  <p>The users email address is their identity, and foreign resources (tokens, and other things) are stored using the email address as a foreign key. Right now I'm saving the users email address in a heavily encrypted string, and when the page loads I look for a cookie, decrypt it, and find the email address and open that account.</p>
  
  <p>Is this secure? Is there a good pattern for storing the users Identity?</p>
  
  <p><strong>GOALS:</strong></p>
  
  <p>I do not want to force my users to have to login every time they visit the website.</p>
  
  <p><em>BUT MORE IMPORTANT</em></p>
  
  <p>It needs to be secure.</p>