Storing custom data in Redis

Question

Our Sitecore 9.2 PaaS website uses federated authentication for logging in our end users, and we are looking for a secure place to store refresh- and access-tokens (pref. serverside). We would prefer to not create a new SQL database just for storing tokens, so we are considering using the Redis cache, which comes "out of the box" with Sitecore 9.2.

Is that a suitable place for storing access- and refresh tokens or is there something we should be aware of? Is it only meant for storing session data initially?

Answer 1

We are using this same approach in our Sitecore solution. The main challenge we ran into is that the SecurityTokenValidated event from the OWIN middleware, where you receive the token, runs before the AcquireRequestState lifecycle event from IIS where the session state gets instantiated. Therefore we were unable to use the Sitecore private session state build by Sitecore.SessionProvider.Redis.RedisSessionStateProvider

You might need to read the session cookie manually and use it as the key for Redis or some other custom solution which works for your requirement. Interacting with Redis without Sitecore through the StackExchange.Redis driver is straightforward. Note that is it recommended to store and reuse the ConnectionMultiplexer object:

//write the token
var connectionMultiplexer = ConnectionMultiplexer.Connect(redisConnectionString);
IDatabase db = connectionMultiplexer.GetDatabase();
await db.StringSetAsync(key, token, ttl);

//read the token back        
var tokenFromRedis =  await db.StringGetAsync(key);