问题
Is storing an OAuth 2 token in cookies bad practise? If so, what are alternatives for a web app?
回答1:
I definitely wouldn't do it. When security is involved you should not store stuff, in places where others can access it. So don't store it anywhere, especially client-side.
That being said, it's not bad practice, per se if handled properly. See this comprehensive article about it.
回答2:
Whether you can store the access_token in cookies depends on following things:
- Is the access_token stored in cookie encrypted or not (it definitely should be)
- Access_token is a bearer token so it is not tied to browser flows. Cookies in general are meant for maintaining state in browsers. So if lifecycle of token is same as cookie, go ahead otherwise not. When I say lifecycle, I mean lifespan, etc.
- Also, please consider this fact too that access token is not identity token
- Access tokens are completely client side, and servers that generally use cookies to maintain sessions, mostly maintain matching server side session as well.
I hope this helps.
回答3:
Cookies have maxSize of 4kb. So if you are saving a lot of info in the token - you will get an error.
来源：https://stackoverflow.com/questions/41076736/is-storing-an-oauth-token-in-cookies-bad-practise