Contents
Is it safe to store access token in browser?
A JWT needs to be stored in a safe place inside the user’s browser. If you store it inside localStorage, it’s accessible by any script inside your page. This is as bad as it sounds; an XSS attack could give an external attacker access to the token.
Where are access and refresh tokens stored?
Access token and refresh token shouldn’t be stored in the local/session storage, because they are not a place for any sensitive data. Hence I would store the access token in a httpOnly cookie (even though there is CSRF) and I need it for most of my requests to the Resource Server anyway.
Can a client refresh an OpenID Connect token?
The OpenID Connect spec prohibits refresh tokens for public clients (clients that have no back end and cannot securely store a client secret), but silent authentication provides a mechanism for attaining a new access token without a redirect.
How are client ID and secret passed in OpenID Connect?
The client ID and secret are passed via the Authorization header. Apart from HTTP basic authentication OpenID Connect also supports authentication with a JWT, which doesn’t expose the client credentials with the token request, has expiration, and thus provides stronger security. The token request parameters are form-encoded:
Is the access token stored in the browser?
OpenID Connect: Is storing access token in browser secure? I’m currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered by different web services.
What does OAuth 2.0 mean for OpenID Connect?
OAuth 2.0 also means having one protocol for authentication and authorisation (obtaining access tokens). Simplicity: OpenID Connect is simple enough to integrate with basic apps, but it also has the features and security options to match demanding enterprise requirements.