I've been struggling to implement tokens into my website and was wondering if I actually need them.
The website was created using React and our database plus our storage is hosted on Google Cloud. I've added specific IP address to include employees' home IPs and a CIDR range to include just enough open ports on our current wifi. Even if you were to gain access to the website the data won't load for anyone outside of these IPs.
All my passwords are already hashed out on our database and considering the fact that data can't even be loaded/pulled from the cloud without being on specific networks is there any reason I need to include tokens? I understand the importance of them on public websites but on a website where all the passwords and usernames were manually inserted into the DB and no one is able to add or remove them outside of me do I really need to implement tokens?