Token Security in Single Page Applications
summary
Explains that localStorage persists across tabs and restarts and is trivially readable by any same-origin script so XSS can steal access and refresh tokens; demonstrates extracting stored tokens by setting an image src to exfiltrate JSON. Shows refresh token rotation (one-time use) reduces attacker window but fails if malicious script continues to act like the user. Recommends isolating token handling in a worker or, better, a backend‑for‑frontend that keeps tokens on the server, and focuses on preventing XSS rather than vague promises.
AI-written summary · about
chapters (6)
- 0:00Introduction to token storage
- 2:10Local storage security risks
- 8:31Cookie security and XSS attacks
- 15:32Token theft scenarios
- 23:16Frontend security with BFF pattern
- 27:53Preventing JavaScript execution attacks
related talks
26mSecuring Single Page Applications with Token Based Authentication
30mSingle Page Applications: Is your design secure?
31mToken Up: Keeping Hands out of the Cookie Jar
57mThe insecurity of OAuth 2.0 in frontends
27mAuthentication in Single Page Applications
28mA Token Walks Into a SPA...
27mMastering Secure Single Page Apps & APIs
14mDetecting session hijacking using rotating refresh tokens in web applications