3 ms·
Ask HN: Is using/storing id tokens in the browser considered save now?
Looking at the firebase documentation it seems it is simply possible for the client side javascript to obtain the odic id token via getIdToken.
A few years ago this was considered unsave and instead sessions should be used an the session Id should be replaced by the JWT token on the server side.
I'm wondering what is the current best practice?
- compressedgas 4y agoThe documentation states that the ID returned by getIdToken is a JWT token. https://firebase.google.com/docs/reference/js/v8/firebase.User https://firebase.google.com/docs/reference/js/v8/firebase.Us... https://firebase.google.com/docs/auth/admin/verify-id-tokens https://firebase.google.com/docs/auth/admin/verify-id-tokens
- WolfOliver 4y agoIf I'm not mistaken, in the context of openid connect all id tokens are JWT tokens. At least it is the most common version.