This article discusses best practices for storing access tokens in the browser and highlights different storage solutions available. It covers browser threats such as cross-site request forgery (CSRF) and cross-site scripting (XSS) and provides recommendations for mitigating these risks. The article also introduces the token handler pattern as a design pattern for secure authentication and making authenticated calls to APIs in JavaScript applications.

15m read timeFrom thenewstack.io
Post cover image
Table of contents
Obtaining Access TokensBrowser ThreatsStorage Solutions in BrowserThreat MatrixOAuth Semantics with CookiesThe Token Handler PatternConclusion
1 Comment

Sort: