OAuth2 authorization - save token in the cookies or in the session?

Question

I'm a security newbie. I'm implementing oauth on my site and I want to ask where I should save my access token:

cookies
session (will be fetch from the server via ajax request)

I have backend (restful) and frontend (SPA). Communication only between them.

By the way what is recommended expire time for oauth?

score 3 · Answer 1 · answered May 26 '14 at 09:35

3

Storing the access token in cookies may be vulnerable to some client side attacks (stealing user cookies for example). Use session instead and HTTPS for communication.

answered May 26 '14 at 09:35

TMR_OS

218
2
10

3

but what if stateless authorization like oauth is required? – Pleerock May 27 '14 at 19:17

score 3 · Answer 2 · answered Oct 07 '14 at 08:59

Depending on different flows that you want or have to use (authorization code, implicit grand, resource owner password or client credentials flows) you might need an authorization token and definitively an access token. The authorization token can be stored in the database and can have TTL of more days whereas the access token (around 5 min or configurable) is more short lived and can be stored on the server into a list accessible by different clients (synch!). OAuth2 doesn’t make use of signature and therefore HTTPS is a must. The token shouldn’t be stored inside as the cookie as it’s not place to be for different reason (cache, transport vulnerability, ..). As the access token is linked to the user it can be saved inside the session of the client application.

score 0 · Answer 3 · answered Feb 13 '14 at 08:21

0

Maybe it's simpler to use a library that managed it correctly for you.

Check this javascript library

answered Feb 13 '14 at 08:21

Nereis

491
5
7

it implements OAuth 2.0 Implicit Flow, I dont need it, I have an oauth server – Pleerock Feb 13 '14 at 12:34

OAuth2 authorization - save token in the cookies or in the session?

3 Answers3