A Token Walks Into a SPA...

on YouTube ↗43m

" summary

Compares a driver’s license to a JWT and shows a concrete SPA flow: authentication server issues an access token, the SPA stores token in memory and sends it with Axios as a Bearer header to API endpoints guarded by an Express check JWT middleware. Recommends not using localStorage/cookies for tokens, uses a secure session cookie on the auth domain plus silent auth via iframe to renew short-lived RS256-signed tokens. Notes token size (~300+ bytes) and suggests a server-side blacklist for revocation.

AI-written summary · about

" chapters (11)

1. 0:00Introduction to SPA security
2. 2:25Traditional vs modern app security
3. 6:42JSON web tokens explained
4. 8:08Real-world token analogy
5. 17:40Token auth in SPAs
6. 22:34OAuth2 flow with SPAs
7. 25:46Storing tokens securely
8. 27:13Silent authentication
9. 28:39Additional JWT resources
10. 30:09Security considerations
11. 31:14Summary and closing

" related talks

• 24mA Token Walks Into a SPAIgnacio Anaya · VueConf TO 2018
• 28mA Token Walks Into a SPA...Ado Kukic · ngVikings 2018
• 40mKnock knock, who's there? Authenticating your single page apps using JSON Web TokensSam Bellen · GrillJS 2019
• 34mAuthenticating your single page apps using JSON Web TokensSam Bellen · apidays Singapore 2019
• 26mSecuring Single Page Applications with Token Based AuthenticationStefan Achtsnit · WeAreDevelopers Conference Vienna 2016
• 37mKnock knock, who's there? Authenticating your single page apps using JSON Web TokensSam Bellen · Jfokus 2019
• 29mKnock knock, who's there? Authenticating your single page apps using JSON Web TokenSam Bellen · AngularDay 2019
• 27mCookies versus tokens: a paradoxical choicePhilippe De Ryck · NG-BE 2017