Where is it acceptable to store an access_token?

Question

Obviously it isn't safe to broadcast any access_token to the public, especially those which are defined with no expiry date. It would also be considered a security issue if a list of registered access tokens was available by SQL injection or something else.

But is it considered unsafe to store an access token in localStorage? What about cookies? Is that 'too dangerous'? They would only be stored in order to keep the user signed in after a reload. Once they expire, the tokens would be deleted from storage and the user asked to sign in again.

Answer 1

localStorage and cookies are both fine. Those are storage locations only accessible for the current domain and current user on their device. If an attacker has already access to the device all bets are off. It rather involved being on the other side of this airtight hatchway

Cookies have the option to be 'http-only' which, once set, will send its content on each subsequent request for its path. Those http-only cookies can't be read by JavaScript so in the event malicious JavaScript got inserted in your page, they won't be able to read those cookies. This does have the consequence that your own JavaScript won't be able to read the cookies either. Your logic that needs the access_token has to be on a server.

LocalStorage is permanent storage, as it will retain its values when a page is reloaded or even when the browser get closed. There also is SessionStorage. That is storage kept for an origin in a specific tab. One of its key features that might be of benefit for security purposes is:

Closing a tab/window ends the session and clears objects in sessionStorage.

So, if your scenario requires a user to obtain a new access_token everytime they start using your app, then sessionStorage should be preferred over localStorage.

Do know we have a site Information Security with a ton of knowledge already on how to deal with security aspects of code and systems.