Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After the Twitter oauth process, once I finally get my access_token_key and access_token_secret is it safe to store these in a javascript variable client side?

As far as I can work out nothing can be done with these keys without the consumer_key/consumer_secret?

Basically to avoid storing anything in the session if I need to make another API call.

share|improve this question
did you mean access_token_key and access_token_secret ? – CodeExpress Oct 17 '12 at 22:43
yes, sorry corrected. – coffee Oct 17 '12 at 22:44
Is the variable in a frame whose origin is the same as a frame which contains third-party content? – Mike Samuel Oct 18 '12 at 3:33
up vote 3 down vote accepted

As with all security considerations it helps to be clear about who you are defending and who you are defending against. Your clients are fairly safe in this environment though perhaps they could mess with you a bit. Someone could write another twitter client and that client could pretend to be your client. If it misbehaves and Twitter bans it, you could be banned as collateral. This assumes that the Twitter API calls are being made client side so the client needs to have enough information to act on your behalf (from Twitters perspective). If you make all API calls server side and don't share your access codes then nobody can modify your client or impersonate it.

If it makes you feel better most twitter clients have this problem...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.