title: How to convert bearer token into authentication cookie for MVC app
body: <p>I have a 3 tier application structure. There is a cordova js application for end-users, an implementation of identityserver3 which serves as the OpenID authority, and an MVC app which will be access through an in-app browser in the cordova application.</p>
  
  <p>The starting entry point for users is the cordova app. They login there via an in-app browser and can then access application features or click a link to open the in-app browser and visit the MVC app.</p>
  
  <p>Our strategy for securing the MVC website was to use bearer token authentication, since we already logged in once from the app and didn't want to prompt the user to login again when they were directed to the MVC app:</p>
  
  <pre><code>app.Map("/account", account =&gt;
  {
      account.UseIdentityServerBearerTokenAuthentication(new IdentityServer3.AccessTokenValidation.IdentityServerBearerTokenAuthenticationOptions()
      {
          Authority = "https://localhost:44333/core",
          RequiredScopes = new string[] { "scope" },
          DelayLoadMetadata = true,
          TokenProvider = new QueryStringOAuthBearerProvider(),
          ValidationMode = ValidationMode.ValidationEndpoint, 
      });
  }
  </code></pre>
  
  <p>Since persisting the access_token on the query string is painful, I implemented a custom OAuthBearerAuthenticationProvider:</p>
  
  <pre><code>public class QueryStringOAuthBearerProvider : OAuthBearerAuthenticationProvider
  {
      private static ILog logger = LogManager.GetLogger(typeof(QueryStringOAuthBearerProvider));
      public override Task RequestToken(OAuthRequestTokenContext context)
      {
          logger.Debug($"Searching for query-string bearer token for authorization on request {context.Request.Path}");
  
          string value = GetAccessTokenFromQueryString(context.Request);
  
          if (!string.IsNullOrEmpty(value))
          {
              context.Token = value;
              //Save the token as a cookie so the URLs doesn't need to continue passing the access_token
              SaveAccessTokenToCookie(context.Request, context.Response, value);
          }
          else
          {
              //Check for the cookie
              value = GetAccessTokenFromCookie(context.Request);
              if (!string.IsNullOrEmpty(value))
              {
                  context.Token = value;
              }
          }
  
          return Task.FromResult&lt;object&gt;(null);
      }
      [cookie access methods not very interesting]
  }
  </code></pre>
  
  <p>This works, and allows the MVC application to not have to persist the access token into every request, but storing the access token as just a generic cookie seems wrong.</p>
  
  <p>What I'd really like to do instead is use the access token to work with the OpenID endpoint and issue a forms-auth style cookie, which responds to logout. I found that I can add <code>account.UseOpenIdConnectAuthentication(..)</code> but if I authenticate via access_token, the OpenIdConnectAuthentication bits are simply skipped. Any ideas?</p>