Why you shouldn’t use access tokens in your front-end any more (2024)

FAQs

Why you shouldn’t use access tokens in your front-end any more? ›

The token is stored at the client-side. This makes it easier for an attacker to obtain the access token.

JWTs which just store a simple session token are inefficient and less flexible than a regular session cookie, and don't gain you any advantage. The JWT specification itself is not trusted by security experts.

Option 1: Store your access token in localStorage : prone to XSS. Option 2: Store your access token in httpOnly cookie: prone to CSRF but can be mitigated, a bit better in terms of exposure to XSS. Option 3: Store your refresh token in httpOnly cookie: safe from CSRF, a bit better in terms of exposure to XSS.

XSS attack: storing JSON web tokens in LocalStorage makes them susceptible to a XSS attack. Lack of Encryption: LocalStorage does not provide built-in encryption, encrypted tokens make the stored data virtually inaccessible if an attacker gains access to the user's device.

If the request to the 3rd party API is through your server, store the access token in the database tied to the user, encrypted with a key that is stored as an environment variable. If the database is compromised, the tokens are safe.

The criticisms of JWT seem to fall into two categories: (1) Criticizing vulnerabilities in particular JWT libraries, as in this article. (2) Generally criticizing the practice of using any "stateless" client tokens. Because there's no great way to revoke them early while remaining stateless, etc.

Disadvantages of JWT Authentication:

Limited Token Expiry Control: Once issued, JWTs remain valid until they expire. Revoking a JWT before expiration requires additional complexity, such as token blacklisting. Security Risks: If the secret key used to sign JWTs is compromised, attackers can create forged tokens.

If your app needs to call APIs on behalf of the user, access tokens and (optionally) refresh tokens are needed. These can be stored server-side or in a session cookie. The cookie needs to be encrypted and have a maximum size of 4 KB.

However, they do not need to be stored in the client because the back end performs the API calls. We recommend storing tokens on the server, as this offers traditional web apps the maximum level of security. If this cannot be done, you should use encrypted session cookies so the client cannot read token values.

In choosing either JWT or cookies storage, functionality, needs and target should be considered before concluding on what to use. However, JWT can be stored inside Cookie. This method is safer because attackers won't be able to steal your user's token easily.

What is the vulnerability of storing JWT in local storage? ›

Vulnerability to XSS Attacks: The primary security concern with Local Storage is its susceptibility to Cross-Site Scripting (XSS) attacks. If an attacker can inject malicious scripts into your web application, they can access Local Storage and retrieve the stored JWTs, leading to potential security breaches.

To reiterate, whatever you do, don't store a JWT in local storage (or session storage). If any of the third-party scripts you include in your page is compromised, it can access all your users' tokens. To keep them secure, you should always store JWTs inside an httpOnly cookie.

Embrace HTTPS: Do not send tokens over non-HTTPS connections as those requests can be intercepted and tokens compromised. Consider all of your authorization use cases: Adding a secondary token verification system that ensures tokens were generated from your server may be necessary to meet your requirements.

The JWT app type will be completely deprecated as of June 2023. New and current users have 12 months to migrate their JWT based solutions to the Server-to-Server OAuth app type.

When using a personal access token in a script, consider storing your token as a GitHub Actions secret and running your script through GitHub Actions. You can also store your token as a Codespaces secret and run your script in Codespaces.

After retrieving a token, store it in an in-memory cache, like Memcached, or a built-in ASP.NET cache service. By default, Access Tokens are valid for 60 minutes, but we recommend setting the expiration time to around 50 minutes to allow for a buffer.

JWTs for session management are a great solution if: Your performance needs require that your app needs to be able to validate sessions without an external network request on every call. You're using Stytch session management to authorize actions outside of your app and that authorization works via JWTs.

Any way,you shouldn't store a JWT in local storage (or session storage). If you store it in a LocalStorage/SessionStorage then it can be easily grabbed by an XSS attack. If the answer is helpful, please click "Accept Answer" and upvote it.

JWTs aren't encrypted

If your web application needs to store sensitive information in tokens, the website needs to handle them with caution. Generally, you should avoid storing sensitive information in tokens because it is very difficult to protect them against all possible cybersecurity attacks.

Choosing a proper method

If your application handles sensitive data or requires rapid revocation, session-based authentication may be the better choice. If your application needs fast, efficient authorization or requires more interaction between the client and server, token-based authentication may be more suitable.