is it safe to set access token to redux state for persistent session in React Native?

user_4711049 0
Viewed 1623

I'm trying to figure out a secure way to persist session in react native.

I have some sensitive data like access token retrieved from server that i'm planning to set to the redux state.

I'm not sure if it is safe to set sensitive data like accessToken to redux state.

If not safe, should i save the accessToken to device storage like react-native-keychain and load the accessToken on every screen request and server request?

dispatch({type: LOGIN_SUCCESS, payload: {refreshToken, authTimestamp, email} });

const INITIAL_STATE = {    
    token: {      
        accessToken: '',          
        loading: false,
        error: ''
    }
};
redux react-native
1 Answers

Yes you should be saving the accessToken in device secured storage, if you plan on storing it at all. The refreshTokens likely should never leave your server as that is possible security vulnerability for the continual generation of new accessTokens.

You can load the accessToken everytime. Another alternative would be to store the accessToken in a secure cookie and pass that back to the app, then you wouldn't have to worry about the management of the tokens at all.

Then there is a question of how you are going to populate that, usually you integrate with an authentication service and an authorization provider. These are two different additional steps to secure your app. I assume you already have off the shelf solutions (if not make a comment and I'll add some examples here)

user_50918740
Related