1

We maintain a web API which is secured with OAuth. To use the API, you must authenticate with our auth server. The auth server responds with an access token, refresh token and expires value (int). The access token is required to communicate with the web API.

We would like to develop an SPA-style web app (using Angular JS or similar) which talks to the API.

I have been researching best practice for this in terms of security but am finding a lot of contradictory information.

Can someone please advise best practice from a security point of view. For example:

a) Is it considered safe to send the access token and refresh token to the browser (using https, obviously)? b) Is it better to use a header to send the token from the web app rather than a cookie, from the point of view of preventing CSRF attacks? c) Is it considered safer to communicate with the web API via a proxy server which generates a new token using the OAuth tokens somehow and sends that to the browser instead?

Apologies if the question seems vague. I'm looking for the 'canonical' workflow to use for a web app, if such a thing exists.

Stack overflow is warning me my question is subjective, but presumably there are evidence-based guidelines on this?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.