Storing OAuth 2 Access Token for javascript only client

Question

One of the use cases of doing Implicit Grants for OAuth 2 is for web apps that use javascript. My question is how do you store the access token?

For web apps with server side scripting I normally store the access token in a database or in a cookie that's not JS accessible. For a mobile app which also uses implicit grant, you can store the token in the device. But for a JS web app, the only way I could think of is to store it in memory in a private variable. The difference with having server side scripting is with this is that once the page is closed, you're technically logged out. But how is this normally done?

Rafael Zeffa · Accepted Answer · 2015-08-18 14:58:22Z

1

You can store in the HTML5 Web Storage

$window.sessionStorage.token = 'serverToken';

The data persisted there lives until the browser tab is closed.

You also can store in a cookie, you can read more about that here: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/

answered Aug 18, 2015 at 14:58

Rafael Zeffa

2,43424 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

karun chaudhary Over a year ago

due to the XSS risk of using HTML 5 Web Storage I guess having a bit of server side scripting is still safest. thanks

Rafael Zeffa Over a year ago

yes, its not totally safe, if your app needs a strong security, I don't recommend you send the token for each request, the better way is make it statefull and use a CSRF protection

Collectives™ on Stack Overflow

Storing OAuth 2 Access Token for javascript only client

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related