I’m working on a project where I was mandated to save access_token and refresh_tokens inside the cookie as file/database written was prohibited. Please do not go into the mute discussion of better approaches, this is what I’m stuck with, I’ve already travelled that road.

Having said that, I’m wondering where is the best place to put them. Right now the user gets redirected to the oauth server and then after all necessary steps I end up with access_token and refresh_token. I am wondering if I can store them inside the claims or should I write a specific cookie to store them into. I figured since claims are encyrpted and signed, it would be safer place to put them.

My main concern is persisting login post publish and if size can become the issue; and I guess any other critical concerns I’m not aware of.