I'm currently working on an end user Windows 10 application using the Microsoft UWP platform. Within this application the end user will be able to authenticate themselves using an oauth2 SSO service.
So here is the question:
Where should the client application (the Windows 10 app) store the access token and the refresh tokens ?
I've been looking a multiple options:
Just save the access token and the refresh token in the Windows Password Vault at user level (not encrypted).
Use the data protection provider for encryption and store the token values in a simple config file.
What would you guys do ?
The main goal is for me to keep the credentials safe from malware that might steal the tokens and also make sure that the only person who can see the token values is my application and the end user itself (the person who used the SSO service).