API Token Safety in Angular application
问题 I'm building an Angular app with an API backend. On a combination of pieces of advice, I built the API with a flavor of token authentication. The flow is roughly as follows: POST to login endpoint with credentials Validate credentials and authorization, then generate a new token Return token to client Client uses token via HTTP Basic to access API resources This is all working well. The problem arises in creating a session based on this token. I don't believe I should simply hold the token on