How and where to store access token securely

user_574019 0
Viewed 1212

I know this question has been asked many times but frankly I have not seen an answer that satisfies the criteria I have.

So I have a ASP.NET WEB API that issues an access token (JWT) when user/pass are provided. At the moment requests are coming from an SPA application. The problem I have is storing the access token so it can be resent to the API from JavaScript. So far it looks like there are 2 commonly suggested options

  • HTML5 Web Store
  • Cookies

But none of these is actually secure since they are not protected from XSS and CSRF. And on top of that it makes token easily accessible.

Any options you would suggest ?

jwt asp.net javascript c#
1 Answers

Web store is vulnerable to XSS. Cookie is vulnerable to XSS if not HTTPONLY. Cookie is vulnerable to CSRF when not STRICT, even if it is HTTPONLY.

So I think we can store the access token in memory. Issue with that is there is no persistence between page refreshes. So for persistence we can store a refresh token in web storage or a cookie and whenever we do not have an access token we can get a new one silently with a refresh token.

When using an identity server a refresh token will not be of any use to any unauthorised client.

So if they XSS and steal the refresh token or CSRF with the refresh token cookie they cannot impersonate the user or get the access token.

user_12572270
Related