3
votes
Accepted
Where is it acceptable to store an access_token?
localStorage and cookies are both fine. Those are storage locations only accessible for the current domain and current user on their device. If an attacker has already access to the device all bets ...
rene♦
- 2,327
Only top scored, non community-wiki answers of a minimum length are eligible