3 ms·
I can't use http only cookies, because I have no server to set them. I'm using JavaScript on the client to do the post to get the tokens. Storing in memory is
by taeric 2y ago
I can't use http only cookies, because I have no server to set them. I'm using JavaScript on the client to do the post to get the tokens. Storing in memory is mostly fine, though I do want them in a cookie. May be able to skip that.
I will look into the dpop thing. A bit limited as I'm using AWS cognito.
I confess my thread model is such that I think I am fine with storing token in local storage. Would like to be using standard practice, though.
- mooreds 2y agoYeah, if you don't have a backend server, you're pretty limited in your options. Sounds like you have spent some time thinking through your threat model and arrived at what works within the constraints of your system. Here's a good resource on general threat modeling I found: https://github.com/segmentio/threat-modeling-training https://github.com/segmentio/threat-modeling-training
- taeric 2y agoI'd be a liar if I said I had fully modeled things. I apologize for making it sound like I hadn't given it any thought. I was hoping I had missed some updated guidance on how to manage tokens. Way too much of the documentation I was finding on OpenAPI and OAuth seemed to be aspirational and referencing things that hadn't come to be, yet. It has gotten rather frustrating. Thanks for the link, it is a surprisingly fun topic to read on.