How to store access token ?

[atakansn]

I am using adonis js as api, how (localstorage, cookie) should be stored by the browser after the user logs in? If I show access token to the user, will it create a security problem?

[RomainLanz]

Hey @atakansn! 👋🏻

If you can store your token inside a cookie, you should have used a session-based authentication instead of an OAT.

If your frontend application is using a proxy to query your real API, it makes sense to have an OAT and create a cookie in your proxy.

If not, store your token in memory or inside the LocalStorage of your frontend application.

[atakansn]

For example, oat_Mw.aVZIQ1otcTFwQlVIdEZ3S0VTVUMwX2xYNkdhVmdXdDNEdTVWcGwzeTE1OTUxNjkzOQ, storing such an access specifier in localestorage and showing it to the user does not create security, right?