web api - how to decrease the length of access token in web api

Question

Hi All, How to decrease the length of access token as its looking lengthy. ex: { "access_token": "hFF8AXzICSbcOLDSKwLUYcU6SNPL_r80SeJzKE0qQ3tMe0yPofn1IC7MwLb24p5xpK_s6OM0uVhE7q2LsSTlLjt9C9iRqnAKKOo6pSov1sa-OJpsFCmhR0rRiMDtgXBs5g-k3VZc_EsoXzAFK6wfY-xHMxG8pRujkTeY1_kja_nm-jr7Bie678vImXD8IbyRMnINL0qUQcBMUOt1LNCn0dnq5JxGZGZ1bUP8RfeNRU_Mi0MwoaMB0hNqAxiRZs92", "token_type": "bearer", "expires_in": 1799, "refresh_token": "f6f75bf4-bc7b-4379-9da1-a4d14a09fae1", ".issued": "Thu, 24 Dec 2020 13:51:27 GMT", ".expires": "Thu, 24 Dec 2020 14:21:27 GMT" } code OAuthOptions = new OAuthAuthorizationServerOptions { TokenEndpointPath = new PathString( "/oauth/2/token" ), Provider = new OAuthAppProvider(), AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(30), //FromDays(2), AllowInsecureHttp = true , // In production mode set AllowInsecureHttp = false RefreshTokenProvider = new OAuthCustomRefreshTokenProvider() // We will create };

Sachin Singh · Answer

OAuth has different flows , the one which you are following is called as Resource Owner Password Credentials flow , what you are doing is completely valid. In order to implement a custom authorization server , follow my article https://www.sharpencode.com/article/WebApi/authentication-authorization/token-based-authentication

Ashok · Answer

Hi Sachin, Thank you for the reply. If you have that custom provider pls share it.And, also suggest me is the below authentication is ok or need to implement anything else. Actually i developed web api for my client to pull data from our server So i implemented security like bearer token with below credentials userName=abc@domain.com&password=password&grant_type=password tested in postman everthing is working fine.And i am giving the below to the client to authenticate and fetch data is the process correct or need to add any access_token URL to get access token and(giving to client) data URL for pulling data based on access token(giving to client) Thank You

Sachin Singh · Answer

This is defaut Token generated when you use in-built Oauth provider of Owin.Security it conatins information of Policies and Roles so you can not manipulate its length by decrease it. You need to write your own Provider by Extending OAuthAuthorizationServerProvider which is time consuming , also the default length is not that hige that it would impact on performance, so keep it as it is.

Ashok · Answer

Hi Sachin, AccessTokenExpireTimeSpan = TimeSpan.FromDays(1) As i am using the above line in my code to use accesstoken for 24 hours if i requested the token lessthan 24 hours its generating new token then total 2 keys are there within 24 hrs of time. if the first token is expired then only i need a request for the new accesstoken.how can i acheive this. Thank You.