Is it ok to store session_state in the client's local storage?

Viewed 1517

I am using OpenId with Keycloak for the authentification management in a web application. I would like to use the session_state value given by Keycloak to manage session data using the OpenId definition of a session, not the browser definition. I mean I don't want to have two sessions when I log once and open my web app in two tabs.

Is it ok to store session_state in the client's browser local storage?

First I thought about the refresh token but then I read it's not recommended to store it outside a secured cookie. I don't find any similar recommandation about the session_state. session_state cannot be used to access any data right?

1 Answers

According to the OpenID Connect Session Management draft the session state must be accessible by Javascript so it can be kept in local storage (the spec even says that it can be kept in local storage).

Related