Assuming the need for OAuth

Imagine an application that is:

  1. A single page web application hosted on S3
  2. Authenticated using implicit OAuth flow implicit
  3. Have the web application access resources with their JWTs

This exposes the session to the JavaScript and requires hardening of the client to protect the user's session.

I understand that conventionally, the session has been stored in an http-only cookie. Where, what is essentially a proxy server which hosts the client, is responsible for accessing resources using the session stored in a cookie.

While the former approach simplifies development and is more akin to native app development, is it too insecure to be a technique to be considered?

What type/size of project would be an example of an acceptable use case? Twitter? Reddit? Finance Provider? Banking institution?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.