asp.net web api - Where does Web API store generated tokens in order to validate subsequent requests? -

i have web api , angularjs client. api using default authorization provider given visual studio generate token on token request grant_type 'password'.

the angularjs client able bearer token web api calling token endpoint credentials , later passes token perform authorized requests in api.

when angularjs sends token on authorized api call, how web api able validate token? token stored?

i checked in identity tables in sql server, not find fields store token information. checked in configuration file, not stored there either. please me in understanding concept?

raj,

by default token not stored server. client has , sending through authorization header server.

if used default template provided visual studio, in startup configureauth method following iappbuilder extension called: app.useoauthbearertokens(oauthoptions).

this extension coming microsoft.aspnet.identity.owin package makes easy generate , consume tokens, confusing in one. behind scene it's using 2 owin middlewares:

• oauthauthorizationservermiddleware: authorize , deliver tokens
• oauthbearerauthenticationmiddleware: occurs @ pipelinestage.authenticate, read authorization header, check if token valid , authenticate user.

to answer questions webapi able validate token oauthbearerauthenticationmiddleware, ensure token sent through authorization header valid , not expired. , token stored client, if client loose it, have request new one.

i advise deeper in oauth protocol, , instead of using extension useoauthbearertokens, take @ useoauthauthorizationserver , useoauthbearerauthentication, better understand how works.