Where to save the token information?

Question

I'm currently working on an end user Windows 10 application using the Microsoft UWP platform. Within this application the end user will be able to authenticate themselves using an oauth2 SSO service.

So here is the question:

Where should the client application (the Windows 10 app) store the access token and the refresh tokens ?

I've been looking a multiple options:

• Just save the access token and the refresh token in the Windows Password Vault at user level (not encrypted).

• Use the data protection provider for encryption and store the token values in a simple config file.

What would you guys do ?

The main goal is for me to keep the credentials safe from malware that might steal the tokens and also make sure that the only person who can see the token values is my application and the end user itself (the person who used the SSO service).

Answer 1

The easiest is going to be using the DPAPI as its just straight forward function calls. Chrome uses this to encrypt cookies at rest on disk.

However if an attacker is aware this is being used and they can execute code under the user context they can call the same functions to extract data. If this is normal malware, the likelihood is low of this occurring.