Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login.

$SCRIPT_ROOT + '/jscript_get_auth_token',
    // Extract token from data then manipulate .. pass to function etc.
    token = data.result
  • How exactly do you want to manipulate the token and for what purpose? – Ilya Chernomordik May 18 '16 at 17:19

your question title is different to the question in your post.

is it secure to get the token via JavaScript from the server - this depends on the server side validation method in place. assuming these are OK

manipulating the token in JavaScript and then sending to a web socket should be fine as long as server side validation is good.

| improve this answer | |

If you only want to read additional data from the token (like JWT), it is no security threat. Since this part of the token is not even encrypted. If you want to expose some secret keys by hardcoding them or getting them from a web server to change and create a new token, that might be a subject of XSS and so on for example.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.