Is Redux a secure place to store JWT tokens?

Viewed 13673

I've been teaching myself Redux, wondering how secure it is to store JWT tokens in a state of Redux.

For example, here is a reducer which is responsible for setting and resetting a token.

export default function loginReducer(state = {
    token: "",
}, action) {
switch (action.type) {
    case "SET_TOKEN":
        {
            return {
                ...state,
                token: action.data,
            }
            break;
        }
    //other cases here
    return state
}

Then, you can store a token in a following way.

    handleSubmit(values) {
        //Calling an API to get a token.
    }).then((response) => {
            response.json().then((jsonReponse) => {         
             //This is where the token is stored!
        this.props.dispatch(loginAction.setToken(jsonReponse.token));
            });
        });
    }

The main purpose of using Redux is to organise states in one place, so I thought it would be reasonable to maintain tokens there.

However, I haven't found a good information resource which explains how secure/vulnerable it is to do so.

(I found several posts as to localStorage vs Cookies. Apparently Cookies would be a secure place for storing tokens, as far as I've researched)

Any advice will be appreciated!

3 Answers

I know this has been asked a long time ago but thought I'd share in case anyone is looking for a nicer approach.

To answer your question, it can be a secure place to store JWT, but it depends on how you are thinking of persisting the JWT.

Here is my approach. If you are using a SPA frontend, as well as having refresh tokens implemented, you could save that refresh token in a httpOnly cookie, and just get a new JWT when the user starts a new session. This way, there's less chance of CSRF/XSS attacks. I wouldn't say its the most secure as anything is possible in these modern times, but personally I feel like it is safer due to only somewhat exposing the refresh token, even though it is set as httpOnly.

Related