Contents
Where should OAuth tokens be stored?
The client, in OAuth terminology, is the component that makes requests to the resource server, in your case, the client is the server of a web application (NOT the browser). Therefore, the access token should be stored on the web application server only.
Can OAuth token be reused?
Answer to the question “Should I reuse OAuth 2.0 access tokens?” Yes, the token is supposed to be used as many times as you need within the given expiry time (google sets it to 1 hour). After it has expired, use the refresh token to get another access token and use it as many times as you need.
Do we need to store token in database?
It depends. If you have multiple servers of keep the token between server restarts than you need to persist it somewhere. The database is usually an easy choice. If you have a single server and don’t care that your users have to sign in again after a restart, than you can just keep it in the memory.
Which is better localStorage or cookie?
Cookies and local storage serve different purposes. Cookies are mainly for reading server-side, whereas local storage can only be read by the client-side. Apart from saving data, a big technical difference is the size of data you can store, and as I mentioned earlier localStorage gives you more to work with.
How big can third party OAuth tokens be?
The size of third-party tokens must be 2 KB or smaller. For OAuth usage limits, see Apigee product limits. In the usual case, Apigee Edge will generate and store an OAuth token, and return it to the calling application.
Which is the best way to store tokens?
Auth0 recommends storing tokens in browser memory as the most secure option. Using Web Workers to handle the transmission and storage of tokens is the best way to protect the tokens, as Web Workers run in a separate global scope than the rest of the application.
When to use an external OAuth access token?
The external authentication service would typically return a response and, if the credentials are valid, also an access token. After the ServiceCallout, the API proxy needs to parse the response to extract the validity status, as well as the externally generated access_token and possibly the refresh_token.
How big do OAuth tokens have to be in Apigee?
You can use this technique if you would like to configure Apigee Edge to validate tokens that are generated outside of Apigee Edge. The size of third-party tokens must be 2 KB or smaller. For OAuth usage limits, see Apigee product limits.