title: Can I securely store an OpenID Connect id_token and access_token in a cookie if it's marked as HTTP only?
body: <p>I am integrating a legacy application (an ASP.NET MVC 4 app) with OpenID Connect. Once I obtain the id_token and access_token from my OIDC provider I need to store them. In typical fashion they have to be sent 'over the wire' from the client side to the server side because the server side must process the id_token to determine which user made the request. The access_token is not processed by my application. It's just stored in my application until I need to make a request to an API that requires JWT Bearer authentication.</p>
  
  <p>The way I see it is that the id_token and access_token are sent from client and server either way - whether it's an a header or a cookie. Can I store the id_token and access_token securely in a cookie if it's marked as HTTP only?</p>
  
  <p>Edit:
  I should add a little more information about my scenario.</p>
  
  <p>1) My application always uses HTTPS, and all cookies are marked as secure. This removes MITM (Man In The Middle) vulnerabilities</p>
  
  <p>2) Every PUT, POST and DELETE request uses ASP.NET's anti forgery token classes. This protects against XSRF.</p>
  
  <p>3) All input is escaped and sanitized using ASP.NET libraries which removes XSS vulnerabilities.</p>
  
  <p>4) The cookie that would contain the id_token would be marked as http only, removing the ability to read and access the cookie from the client side.</p>