Our Sitecore 9.2 PaaS website uses federated authentication for logging in our end users, and we are looking for a secure place to store refresh- and access-tokens (pref. serverside). We would prefer to not create a new SQL database just for storing tokens, so we are considering using the Redis cache, which comes "out of the box" with Sitecore 9.2.

Is that a suitable place for storing access- and refresh tokens or is there something we should be aware of? Is it only meant for storing session data initially?

  • That’s completely reasonable. Redis is used as a session store in Sitecore but that’s only because it checks all the boxes: quick, detached resource, high though put, independently scalable etc. you can certainly use it to store other data. Redis is ideal for concise key value pairs which sounds like exactly what you described.
    – jrap
    Oct 24, 2020 at 11:13
  • Thanks for the reply! Then I will definitely go forward with this approach. Do you happen to have experience using Redis for this scenario? Also, if you leave an answer I will make sure to mark it
    – Hos
    Oct 24, 2020 at 12:34
  • I will on Monday unless someone answers prior. I believe there are Sitecore abstractions available to make it relatively easy.
    – jrap
    Oct 24, 2020 at 14:28

1 Answer 1


We are using this same approach in our Sitecore solution. The main challenge we ran into is that the SecurityTokenValidated event from the OWIN middleware, where you receive the token, runs before the AcquireRequestState lifecycle event from IIS where the session state gets instantiated. Therefore we were unable to use the Sitecore private session state build by Sitecore.SessionProvider.Redis.RedisSessionStateProvider

You might need to read the session cookie manually and use it as the key for Redis or some other custom solution which works for your requirement. Interacting with Redis without Sitecore through the StackExchange.Redis driver is straightforward. Note that is it recommended to store and reuse the ConnectionMultiplexer object:

//write the token
var connectionMultiplexer = ConnectionMultiplexer.Connect(redisConnectionString);
IDatabase db = connectionMultiplexer.GetDatabase();
await db.StringSetAsync(key, token, ttl);

//read the token back        
var tokenFromRedis =  await db.StringGetAsync(key);
  • Thank you for your answer! I am not sure I understand the section starting with "You might need to read the session cookie manually....". Why would I want to do that? I want to store my user's tokens, and for creating the cache key for Redis, I would use their userId + tokenname. I was planning to use StackExchange.Redis Nuget package to interact with Redis :)
    – Hos
    Oct 26, 2020 at 19:36
  • We need to do that to ensure we retrieve the correct token for the user if user is logged in multiple times from different browser/device. If you don't need this then that part does not apply :)
    – Jeroen
    Oct 26, 2020 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.