I am working on a wordpress plugin that provides a comment thread system kind of like disqus (but different).
In order to login (to post comments) the workflow is like this :
- User clicks on log-in on the wordpress blog
- A popup opens with the login form on the backend api for my plugin (another site)
- The user logs in and using PostMessage I send back an access token.
Now with that access token when he does action like upvoting or posting a comment I'll send a post request to my backend api along with the token and if the token is valid I add the comment/upvote to the database.
But I am not sure how to securely handle the user token : My first thought was to put it in a cookie but then any malicious wordpress blog can run some js to automatically steal all the tokens from users who log onto their websites.
And since all of the logging is happening on the front end of the wordpress blog I don't see how I can store data in a way that the backend api can access it when the user does an action but not a malicious blog.
How can I securely store that token ? I thought about embedding the website in an iframe in order to rely on session variables but I am not sure on how secure that is.