Rails 7.2: Should a short-lived OAuth access token be stored in CookieStore or ActiveRecordStore?

rubyonrails-talk
1

We have a Rails 7.2 application that receives a short-lived OAuth access token from an external identity provider. The token is valid for approximately 30 minutes, and the token must be available across requests and Rails pods during the authenticated user’s session.

The application currently uses:

Rails.application.config.session_store(
  :cookie_store,
  key: "_app_session"
)

Rails encrypts and authenticates the CookieStore contents using secret_key_base, but this means the encrypted access token would be stored in the browser and transmitted with every application request.

We are considering changing to active_record_store so that the browser contains only a session identifier and the token remains server-side.

What is the recommended Rails approach for this use case?

  1. Is storing a short-lived OAuth access token in encrypted CookieStore considered appropriate?
  2. Would ActiveRecordStore be preferred for server-side invalidation and logout?
  3. Does ActiveRecordStore encrypt its data column, or should the access token be encrypted separately before being placed in the session?
  4. How can an expired token be removed from a database-backed session without expiring the user’s entire application session?
  5. Are there recommended patterns for preventing replay of a copied CookieStore cookie after logout?