title: Where to store Bearer Token in MVC from Web API
body: <p><strong>Scenario</strong></p>
  
  <p>I have an ASP.NET Web API that uses the OAuth Password Flow to provide Bearer Tokens to gain access to its resources.</p>
  
  <p>I'm now in the process of making an MVC app that will need to use this API.</p>
  
  <p>The plan is to have the MVC controllers make calls to the API on behalf of the client browser.</p>
  
  <p>The ajax requests from the browser will hit the MVC controllers and then the API calls are made. Results are then fed back to the client as JSON and handles in java-script.</p>
  
  <p>The client should never communicate directly with the API. </p>
  
  <p><strong>Getting Authenticated.</strong></p>
  
  <p>I need to find the best way to handle the Bearer Token once it has been received in the MVC app via a successful call to the web api token endpoint.</p>
  
  <p>I need to use this bearer token in any subsequent calls to the api.</p>
  
  <p>My plan is to store it in the <code>System.Web.HttpContext.Current.Session["BearerToken"]</code></p>
  
  <p>I can then create a custom <code>AuthorizationAttribute</code> that will check to see if a BearerToken is present in the current HttpContext, if it is not present, the client will need to revisit the token endpoint.</p>
  
  <p><strong>Does this seem feasible?</strong></p>
  
  <p>I'm asking for peoples opinion on this as I am not convinced this the best solution for my project.</p>