Security concern, user.storage expose other users idToken, refreshToken, accessToken.

[artidataio]

This has been bugging me for sometime as I have limited knowledge on cyber security especially athentication. I am not sure whether this is the place to ask, but I'll put it here anyway since you guys are pretty responsive. When a user is athenticated, then the browser have access to the user object with keys like username, userPoolId and attributes. This object can be examined easily in React DevTools.

Then there is this storage key in the user object. It contains other users idToken, refreshToken, accessToken. Is it safe for such values to be exposed? Can other users' account get hijacked or jeopardised by knowing such values?

[ericclemmons]

Luckily this has been researched (and debated!) extensively in the Amplify JS repo (which is the underlying client library for the UI):

aws-amplify/amplify-js#3436 (comment)

That would be the best place to continue the discussion 🙏