Full Stackhard

How should tokens be securely stored in a full stack application?

Discuss the best practices for securely storing JWTs and OAuth tokens in both client-side and server-side applications.

Asked at Stripe, Uber, Netflix

#authentication#authorization#security#jwt#oauth

Answer

  • Use HttpOnly cookies for secure storage on the client-side to mitigate XSS attacks.
  • Store tokens in memory (e.g., React state) for short-lived sessions to avoid persistence issues.
  • On the server-side, consider storing tokens in a secure database and implement expiration policies.
  • Always use HTTPS to protect tokens in transit.

Source: custom

Practise more Full Stack questions →