title: Twitter Oauth with ASP.NET MVC, where to store secret token
body: <p>I have a dilemma where to store secret tokens that I receive from twitter. </p>
  
  <p>Options: </p>
  
  <p>a. Put it into FormsAuthenticationTicket, encrypt it and put it into cookie. Is this secure enough?</p>
  
  <p>b. Put it into Session and put user_name into FormsAuthentciation</p>
  
  <pre><code>FormsAuthentication.SetAuthCookie(String.Concat("&lt;em&gt;", screen_name, "&lt;/em&gt;"), true);
  </code></pre>
  
  <p>That way I'd have to check if secret cookies exist in session first. </p>
  
  <p>c. Store secret cookies in the database and store username in cookies like b.</p>
  
  <p>Which one do you recommend and why?</p>
  
  <p>Thanks a lot!</p>