Search code examples
reactjsapisecuritywebsecurity

Is it good practice to store google tokens in local storage

I am bit confused after reading few articles, basically assume you have a web app which uses gmail login for authentication. Is it a good practice to store the google access token in the local storage and send it via headers to verify in back end APIs ? or should I use separate mechanism to handle api level access ?

Solution

  • It does not matter where will you save tokens at front-end, because even in a case when you will be exchanging them witch back-end - you will need to send them with the request. (all data which is placed at front-end is unsecured)

    So everyone will have access to them inside the inspector network tab.

    When a question is going about security, the first rule:

    • Research possibility to implement that at back-end by using environment variables.

    P.S: I just opened Authorizing Your App with Gmail and there are says:

    Get started: To get started, see Implementing Server-side Authorization.

    So you need to handle all of the Authorization actions at back-end where all the tokes will be secured.