hard20 pts · first answer countsauthenticationoautharchitecture

Keeping OAuth tokens out of the browser

A security review says a single-page app should not hold OAuth refresh tokens in JavaScript at all. Which pattern does that?

A.A backend-for-frontend holds tokens and gives the SPA a session cookieB.Store the refresh token in sessionStorage insteadC.Encrypt the refresh token with a key in the JavaScript bundleD.Use the implicit flow so no refresh token is issued

Discussion 0

Join free to post in the discussion.

Keeping OAuth tokens out of the browser

Discussion 0

Related questions