Twitter Oauth with ASP.NET MVC, where to store secret token

Question

I have a dilemma where to store secret tokens that I receive from twitter.

Options:

a. Put it into FormsAuthenticationTicket, encrypt it and put it into cookie. Is this secure enough?

b. Put it into Session and put user_name into FormsAuthentciation

FormsAuthentication.SetAuthCookie(String.Concat("<em>", screen_name, "</em>"), true);

That way I'd have to check if secret cookies exist in session first.

c. Store secret cookies in the database and store username in cookies like b.

Which one do you recommend and why?

Thanks a lot!

Answer 1

Since the token does not expire and your application is considered authorized for that user account, you need to store the token in something that lasts longer than a session.

In that case, I would store it in a database associated with the username.

Answer 2

I would not prefer storing 'username' with token, because user name is actually the screen name you get through xml, and one can easily change it.

Why not to store 'user id' with the token?