Securing Single Page Applications with Token Based Authentication
summary
Explains practical trade-offs for using JSON Web Tokens in single‑page apps: recommends short‑lived tokens plus a refresh flow, avoids localStorage because XSS steals tokens, favors HTTP‑only cookies with a double‑submit cookie CSRF countermeasure, and implements a server‑side revocation list (blacklist) for immediate logout. Covers signature verification, expiration checks, HTTPS requirement, and the engineering cost of refresh and revocation versus the statelessness benefit.
AI-written summary · about
chapters (8)
- 0:00Introduction to single page application security
- 3:56SPA security guidelines
- 5:42Token auth fundamentals
- 9:58How JSON Web Tokens work in practice
- 14:29Cross-site request forgery risks and solutions
- 19:42Token expiration strategies
- 22:11Common security misconceptions in SPAs
- 24:05Delegated token auth
related talks
29mToken Security in Single Page Applications
34mAuthenticating your single page apps using JSON Web Tokens
25mHow JSON Web Tokens Work and Can be Used to Secure Your Single Page Apps
37mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
29mKnock knock, who's there? Authenticating your single page apps using JSON Web Token
27mAuthentication in Single Page Applications
28mA Token Walks Into a SPA...