I'm writing a browser-side SDK that allows sites to access my API.
The API will authenticate a API key (when called from the clients backend), or will authenticate a JWT token for a specific user.
I'm looking for what the best practices are here for authenticating between my SDK in the browser, and my API server. Clearly the client can't put an API key into the browser, so currently I have the client request a token from their server and pass that forward to the SDK.
There seem to be a number of ways to do this, however.
- Store in localStorage (vulnerable to XSS)
- Store as a cookie, but in this case its "hidden" from the client and seems error prone. Additionally cross-site cookies are disabled on many browsers.
This seems like a very common thing to do, so curious how others have solved it.