Question

I was asked not to use Session anywhere in my code. Currently, I’m authenticating the user to the web services interface and storing the access token (an object) in session and re-using it for subsequent requests. What would be a good place to store it on server-side? I don’t want to send it to the client for security reasons.

Here’s the code –

 var person;
    $.ajax({
        url: 'Default.aspx/LoadPerson',
        data: JSON.stringify({ id: 1 }),
        type: 'POST',
        contentType: 'application/json;',
        dataType: 'json',
        success: function (result) {
            person = result.d;
        }
    });

My Web service method looks something like this –

    [WebMethod]
    public static Person LoadPerson(int i)
    {
        var person = new Person();
        person.Name = "Bob";
        var userToken = SetupWebserviceUser();
        HttpContext.Current.Session["UserToken"] = userToken();
        // Call web service, get data.
        return person;
    }

Answer 1

What would be a good place to store it on server-side?

There aren’t too many options left, if you do not want to store the data in the client or in the seesion.
The only options that I can think of is a DataBase\static variable\ XML file.