Skip to content

Latest commit

 

History

History
17 lines (14 loc) · 1.25 KB

auth.md

File metadata and controls

17 lines (14 loc) · 1.25 KB
Raw

Authentication for Single Page Application (SPA)

  • ability to revoke token is important
  • showing list of sessions is also important
  • storing access/refresh token locally in localStorage/sessionStorage is insecure
  • appending 'Authorization ' + token on client side is insecure, this should be done through a reverse proxy with session enabled, and appended there before calling the target resource server
  • otherwise, the token could also be stored in-memory, but will be lost upon refresh/tab change. The client must then call the proxy server to obtain the token through a valid refresh token
  • refresh token is one-time use only, after using it, it will be revoked and a new refresh token is issued (each could be extended with a new expiration date, so as long as the user is active, their token will be long living on the server side)
  • you still need a backend server for persisting session

References