Category Archives: single-page-app

Is it useful to have separate access tokens and refresh tokens if they’re going to be stored on the client-side as cookie?

Posted on by

(This is a followup to my question about a general security scheme here)

As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with a short-lived access JWT … Continue reading Is it useful to have separate access tokens and refresh tokens if they’re going to be stored on the client-side as cookie?→

Is this security scheme using passwords, short-lived access JWTs, and long-lived refresh tokens a good way to secure a REST API?

Posted on by

I’m trying to secure a REST API that I’m using as a backend for a single-page application. The API provides access to read/create/modify/delete protected resources, based on a set of permissions managed by an administrator. What I’m thinki… Continue reading Is this security scheme using passwords, short-lived access JWTs, and long-lived refresh tokens a good way to secure a REST API?→

Is there a way to protect against fake messages by an SPA that consumes a webservice directly?

Posted on by

I develop a webservice currently and communication might be a bottleneck. It would be at least 100ms faster if I could access the webservice from the browser directly instead of sending the messages to the consumer’s server f… Continue reading Is there a way to protect against fake messages by an SPA that consumes a webservice directly?→

Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?

Posted on by

I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without client_secret passed to Auth s… Continue reading Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?→