This article discusses best practices for storing access tokens in the browser and highlights different storage solutions available. It covers browser threats such as cross-site request forgery (CSRF) and cross-site scripting (XSS) and provides recommendations for mitigating these risks. The article also introduces the token handler pattern as a design pattern for secure authentication and making authenticated calls to APIs in JavaScript applications.
Table of contents
Obtaining Access TokensBrowser ThreatsStorage Solutions in BrowserThreat MatrixOAuth Semantics with CookiesThe Token Handler PatternConclusion1 Comment
Sort: