3 votes

Where is it acceptable to store an access_token?

localStorage and cookies are both fine. Those are storage locations only accessible for the current domain and current user on their device. If an attacker has already access to the device all bets ...
rene's user avatar
  • 2,327

Only top scored, non community-wiki answers of a minimum length are eligible